Patent ID: 7478157

Claim:
A method to enforce privacy preferences on exchanges of personal data of a data-subject, comprising the steps of: specifying one or more data-subject authorization rule sets, the data-subject authorization rule set having one or more subject constraints on one or more data-subject data; receiving a request message from a requester, the request message having one or more requests for one or more of the data-subject data pertaining to the a subject, and a requester privacy statement for each of the respective data-subject data requested, wherein the requester privacy statement includes purpose, retention, recipient, and access information, wherein the purpose information specifies the purpose for which the requested data is acquired, the retention information specifies a retention policy for the requested data, the recipient information specifies the recipients of the requested data, and the access information specifies whether the requested data should be accessible to the data-subject after the data has been released; comparing the requester privacy statement to the subject constraints; and releasing the data-subject data in a response message to the requester only if the subject constraints are satisfied.