Help our clients stay legal under “right to be forgotten,” Ernst & Young urges startups

Assuming Europe’s new General Data Protection Regulation passes its final hurdles later this year, it will provide several major headaches for web firms operating in the EU, with none being greater than the formalized “right to be forgotten.” This will be a bigger deal than the “right to be de-linked” that’s currently bothering Google and other search firms – it will give people the right to have information about themselves deleted, even if it is held by third parties.

Auditing and consulting giant [company]Ernst & Young[/company] (EY) knows this, and it has clients who are doubtless quaking in their boots – after all, in this world of platforms and APIs, who knows where their users’ data is, right? That’s why EY launched a data privacy startup challenge at London financial technology accelerator Level39 on Monday.

EY said it wanted to find six startups working on technologies around data capture, processing and erasure, that could help its clients deal with the incoming right. It said the regulation’s expected passage would raise consumer awareness around rights – with this on top of recent high-profile security breaches involving personal data, it said, businesses faced challenges “around reputation management, consumer trust, compliance, operational efficiency and ultimately growth.”

The startups will get mentoring and financial advice over a six-week period, along with “unprecedented access to EY clients and new potential customers.” One winner will also get the “opportunity” of getting an EY professional on board after the program, on secondment.

It remains to be seen whether the full-blown right to be forgotten will actually find its way into European law. The U.K. Lords recently urged that government to fight for its excision from the new regulation, on the basis that it’s unworkable. On the other hand, it may turn out that the messy beginnings of the closely-related right to be delinked will give way to a functioning system that allows people to protect their reputation without sliding into a censorship free-for-all.

It’s a bit too soon to tell, really. Whatever happens, clever wording in the finalized regulation could help make the new right both meaningful and workable, but technological solutions would also need to play a major role – as things stand, there is far too little oversight over where data goes online, to meaningfully protect people’s privacy rights. Which is, after all, the situation that the new law is trying to fix.

So I’m intrigued to see which startups EY will pick for its new program. If technology can help make personal data easier for the subjects to control without introducing new tools for surveillance and authoritarian control – the biggest risk here, in my opinion – then everyone’s a winner. That’s a big “if,” though.