Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments filed 10/23/2025 have been fully considered and are moot in view of the new grounds of rejection presented herein.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claim 1-5, 8-12, 15-18, 20 are rejected under 35 U.S.C. 103 as being unpatentable over US 20240311618 to Sukhavasi in view of US 20220012357 to Rajeev in view of US 20240220674 to Lopez Broz in view of US 20240202452 to Schillace.
Regarding claim 1, Rajeev teaches a computer system for enforcing a privacy policy by scanning unstructured data, the computer system comprising:
one or more processors; and a memory storing executable instructions thereon that, when executed by the one or more processors, cause the one or more processors to:
send a privacy policy and a prompt for privacy enforcement code to a machine learning (ML) chatbot to cause an ML model to generate the privacy enforcement code (¶ 42, receiving prompt to generate code, receiving security and privacy enhancements), and
receive the privacy enforcement code from the ML chatbot (¶ 38-45, receiving code based on prompts),
Sukhavasi fails to teach but Rajeev teaches:
wherein the privacy enforcement code comprises further instructions that, when executed by the one or more processors, cause the one or more processors to:
scan a set of unstructured data, detect one or more potential violations of the privacy policy in the set of unstructured data (¶ 46, scanning unstructured data for violations; ¶ 41, defined policy), and
communicate the one or more potential violations to a user (¶ 46-49, communication of violations indicated by redacted sections; see fig. 5).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of . The motivation to do so is that the teachings of would have been advantageous in terms of automating the process of masking sensitive data (Rajeev, abstract).
Rajeev fails to teach but Lopez Broz teaches:
detect an indication of a new privacy law or regulation (¶ 20, 28, 32, 76, detecting new privacy law), send the privacy policy and the new privacy law or regulation to the ML chatbot to cause the ML model to generate updated privacy enforcement code that complies with the new law or regulation, and receive the updated privacy enforcement code from the ML chatbot (¶28-32, 76, 88, sending policy/law to cause ML model to generate updated privacy enforcement code for compliance).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of . The motivation to do so is that the teachings of would have been advantageous in terms of facilitating risk assessment evaluation and auditing processes (Lopez Broz, ¶ 4, 15, 32).
Lopez Broz discloses the detecting and updating as described above but does not update the ML model via a prompt. However, Schillace discloses sending a prompt that to update the ML model (abstract, ¶ 29, claim 1).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Schillace. The motivation to do so is that the teachings of Schillace would have been advantageous in terms of facilitating training, updating and fine-tuning of ML models (Schillace, ¶ 4).
Regarding claim 2, 9, 16,
Sukhavasi fails to teach but Rajeev teaches:
when executed by the one or more processors, further cause the one or more processors to delete or redact segments of the set of unstructured data comprising one or more potential violations (¶ 46-49, fig. 5). Motivation to include Rajeev is the same as presented above.
Regarding claim 3, 10, 17,
Sukhavasi fails to teach but Rajeev teaches:
wherein the scan of the set of unstructured data comprises scanning a data store (¶ 39, 45, 7, data store. Motivation to include Rajeev is the same as presented above.
Regarding claim 4, 11, 18,
Sukhavasi fails to teach but Rajeev teaches:
wherein the scan of the set of unstructured data, comprises scanning the set of unstructured data received by an application prior to storage in a data store (abstract, ¶ 4, 30, data received by application). Motivation to include Rajeev is the same as presented above.
Claim 8 and 15 are addressed by similar rationale as claim 1.
Claim 7, 14, 20 are rejected under 35 U.S.C. 103 as being unpatentable over Sukhavasi Rajeev, Lopez Broz, and Schillace in view of US 20230316141 to Toporek.
Regarding claim 7, 14, 20,
Sukhavasi fails to teach but Toporek teaches:
train the ML model with a training dataset, and validate the ML model with a validation dataset, wherein the training dataset and the validation dataset comprise a set of privacy laws and/or regulations, a set of privacy policy examples, and/or a set of private information examples (¶ 54, training and validation data set including privacy policies).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Toporek. The motivation to do so is that the teachings of would have been advantageous in terms of facilitating privacy protections (Toporek, ¶ 4-5, 54).
Claims 5 and 12 are rejected under 35 U.S.C. 103 as being unpatentable over Sukhavasi Rajeev, Lopez Broz, and Schillace in view of US 11726889 to Rao.
Regarding claim 5, 12,
Sukhavasi fails to teach but Rao teaches:
when executed by the one or more processors, further cause the one or more processors to: assign one or more severity scores the one or more potential violations, and communicate the one or more severity scores to the user (col. 33:54-67, col. 34:45-67, col. 35:55-67).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Rao. The motivation to do so is that the teachings of would have been advantageous in terms of implementing effective and efficient predictive monitoring (Rao, abstract).
Claims 21-23 are rejected under 35 U.S.C. 103 as being unpatentable over Sukhavasi Rajeev, Lopez Broz, Schillace, and Rao in view of US 20220148113 to Mejia.
Regarding claims 21-22,
Sukhavasi fails to teach but Mejia teaches:
wherein assigning of one or more severity scores further comprises instructing the ML model to assign a weight to one or more attributes of the privacy policy (¶ 9, 47, 61).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Mejia. The motivation to do so is that the teachings of Mejia would have been advantageous in terms of facilitating the detection of security leaks (Mejia, ¶ 4-5).
Regarding claim 23,
Sukhavasi fails to teach but Rao teaches:
assign one or more severity scores to the one or more potential violations and communicate the one or more severity scores to the user (col. 33:54-67, col. 34:45-67, col. 35:55-67).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Rao. The motivation to do so is that the teachings of would have been advantageous in terms of implementing effective and efficient predictive monitoring (Rao, abstract).
Sukhavasi fails to teach but Mejia teaches: wherein assigning of one or more severity scores further comprises instructing the ML model to assign a weight to one or more attributes of the privacy policy (¶ 9, 47, 61). Motivation to include Mejia is the same as presented above.
CONCLUSION
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RYAN J JAKOVAC whose telephone number is (571)270-5003. The examiner can normally be reached on 8-4 PM EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Oscar A. Louie can be reached on 572-270-1684. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/RYAN J JAKOVAC/Primary Examiner, Art Unit 2445