PTAB

PGR2018-00056

AvePoint Inc v. OneTrust LLC

Log In
Key Events
Petition
petition Intelligence

1. Case Identification

2. Patent Overview

  • Title: Computer-Implemented Systems and Methods for Electronic Privacy Campaign Risk Level Assessment
  • Brief Description: The ’090 patent discloses a computer-implemented method for determining the security risk of personal data associated with a "privacy campaign." The system calculates a risk level by receiving campaign data, determining weighting factors and relative risk ratings for various risk factors, and calculating an overall risk level based on those inputs.

3. Grounds for Unpatentability

Ground 1: Patent Ineligibility under §101 - Claims 1-25

  • Core Argument for this Ground:
    • Petitioner argued that all challenged claims are directed to the patent-ineligible abstract idea of assessing risk. The claims recite the fundamental business practice of identifying risk factors, assigning them weights based on their perceived importance, and calculating an overall risk score. This process, Petitioner contended, is a longstanding mental process and fundamental economic practice that is not tied to any specific technological improvement.
    • The petition asserted that the claims fail step two of the Alice/Mayo framework because they do not add an inventive concept. The claims merely recite generic computer components (processors, databases, GUIs) and conventional computer functions (receiving, storing, calculating) to implement the abstract idea. Petitioner argued that the use of terms like "electronically" and "digitally" are mere token additions that do not transform the abstract idea into a patent-eligible application, as they simply describe performing a known business practice on a general-purpose computer. The dependent claims were also argued to be abstract as they only add commonplace features like user access controls, data display options, and formulaic mathematical calculations.

Ground 2: Obviousness over McQuay, Hunton, Clayton, and Belani - Claims 1-25

  • Prior Art Relied Upon: McQuay (Patent 8,966,575), Hunton ("The Role of Risk Management in Data Protection" paper), Clayton (Patent 6,904,417), and Belani (Application # 2012/0110674).
  • Core Argument for this Ground:
    • Prior Art Mapping: Petitioner alleged that the combination of these references teaches all limitations of the challenged claims. McQuay was cited for disclosing a framework for scoring privacy protection processes, including creating and managing electronic "privacy campaigns," using user interfaces to input data, and calculating scores based on weighted factors. Belani was asserted to teach the specific claimed method of risk calculation, disclosing a system for rating mobile app privacy risks by multiplying a "Weight" by a "Rating" for various risk factors and summing the results to yield an "Overall Score." Clayton and Hunton were used to supply specific risk factors claimed in the ’090 patent but not detailed in McQuay, such as the length of time data is retained (Clayton) and the category of the data subject, such as a minor (Hunton).
    • Motivation to Combine: A person of ordinary skill in the art (POSITA) would combine these references to create a comprehensive privacy risk assessment tool. Petitioner argued a POSITA would look to McQuay's campaign management framework and integrate the more specific, formulaic risk calculation method from Belani to improve the scoring process. It would be a simple and logical step to incorporate additional well-known risk factors, such as those discussed in Clayton and Hunton, to make the risk assessment more robust.
    • Expectation of Success: A POSITA would have a reasonable expectation of success in making this combination, as it involved applying known risk calculation techniques (Belani) to a known privacy management framework (McQuay) using established risk factors (Clayton, Hunton). The result would be the predictable aggregation of known elements.

Ground 3: Obviousness over AvePoint's Prior Use - Claims 1-25

  • Prior Art Relied Upon: AvePoint Privacy Impact Assessment (PIA) Tool, a software product publicly used and available since at least February 2015.
  • Core Argument for this Ground:
    • Prior Art Mapping: Petitioner argued that its own publicly available PIA Tool, used before the ’090 patent's filing date, renders the claims obvious. The petition asserted the PIA Tool is a computer-implemented method that performs the core claimed steps. This included providing user interfaces for creating a privacy project (a "privacy campaign"), receiving input data related to the project, and calculating a risk level based on user answers to questions. The PIA tool was alleged to evaluate various risk factors (including the nature of data, location, and access), calculate a total risk value, and assign a "Pass," "Warn," or "Fail" status, thereby determining and storing a risk level for the campaign.
    • Motivation to Combine: This ground primarily asserted that the PIA Tool alone rendered the claims obvious. Alternatively, a POSITA would be motivated to combine the functionalities of the PIA Tool with the teachings of McQuay, Hunton, Clayton, and Belani to refine or expand its feature set, as all references operate in the same field of privacy risk management.

4. Key Claim Construction Positions

  • "determining a weighting factor" and "determining a relative risk rating": Petitioner proposed these terms mean assigning a single overall value to a risk factor, where a higher numerical value corresponds to a higher security risk. This construction supports the argument that the claims simply recite the basic concept of using weighted aggregates.
  • "calculating a risk level for the [privacy] campaign": Petitioner argued this means calculating a risk level based on the sum of the weighted risk ratings for each risk factor. This construction was used to map the claims directly to the mathematical formulas disclosed in the prior art, particularly Belani.

5. Relief Requested

  • Petitioner requests institution of post-grant review (PGR) and cancellation of claims 1-25 of the ’090 patent as unpatentable.