Patent ID: 11960619
Assignee: MORGAN STANLEY SERVICES GROUP INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A computer-implemented method for tracking use of personally identifiable information (PII) by a computer asset of a firm, the method comprising:
receiving, by a computer system, identification of two or more data elements utilized by the computer asset, wherein each of the two or more data elements is a category of personal information, and wherein each of the two or more data elements corresponds to one of a plurality of risk categories;
receiving, by the computer system, identification of an individual type associated with the two or more data elements, wherein the individual type is a category of persons;
determining, by the computer system, whether the computer asset utilizes PII based on the two or more data elements individually or as a combination; and
upon determining that the computer asset utilizes PII:
determining, by the computer system, a sensitivity level of the PII based on a sensitivity classification for the two or more data elements identified for the computer asset;
determining, by the computer system, whether an enhanced data control is necessary for the computer asset based on the two or more data elements identified for the computer asset and based on the sensitivity level for the PII, wherein the enhanced data control modifies access parameters to the PII from the computer asset, and wherein determining whether the enhanced data control is necessary comprises:
categorizing each of the two or data elements into its corresponding risk category; and
determining whether the enhanced data control is necessary by determining an applicable rule from a set of rules, wherein a subset of rules in the set of rules corresponds to an enhanced data control, where the applicable rule is determined based on a combination of quantities of the two or more data elements categorized to each of the plurality of risk categories and based on the sensitivity classification for the two or more data elements, such that at least one rule in the set of rule is applicable to the two or more data elements upon a determination that the combination of quantities of the two or more data elements categorized to each of the plurality of risk categories is greater than zero; and

recording, by the computer system, the individual type, whether enhanced data controls are necessary, and the sensitivity level of the PII in association with the computer asset in a database communicably coupled to the computer system.