Of The EU Right To Erasure. . . Of Prior Collected Data

As a follow-up to my last post, I'll note that -- as written -- the new law would require that Mattersight remove the data from its database as to each EU member-state citizen who revokes his/her consent to be included -- and Mattersight likely must do so, retroactively.

That is, the EU member-state citizen may ask for his or her data to be forgotten, and cleansed from the databases. That, in turn, would be the likely death-knell for the data that Mattersight has already processed -- and sold to client(s).

See Article 17:

. . .Article 17 Right to be forgotten and to erasure

1. The data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data, especially in relation to personal data which are made available by the data subject while he or she was a child, where one of the following grounds applies:

(a) the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or when the storage period consented to has expired, and where there is no other legal ground for the processing of the data;

(c) the data subject objects to the processing of personal data pursuant to Article 19. . . .

So, as I say, I doubt Mattersight will be able to do much on the continent if this law stands as written.

Will The New EU Privacy Directives Spell The End Of Mattersight's Emerging EU Business Model?

In early 2012, the European Commission published draft legislation to establish a single, unified pan-European data protection standard, for all of the EU member jurisdictions. The proposed legislation includes a General Data Protection Regulation applicable in all member states, and thus replaces the patchwork of different data protection laws currently in force throughout the EU. Of primary importance at the moment is the UK, for Mattersight. 

But longer term, it will likely be tough to aggressively grow the Mattersight offerings inside the EU, generally. Why? Because the business model relies, as raw material, on the recordings of customer interactions over the telephone. The stringent procedures for an EU customer "opt-in" -- to allow such recordings of EU member states' citizens -- may effectively mean that only a very small proporion of such customer interactions will lawfully be available for Mattersight analysis. You may read the full test of the new EU privacy law here (a PDF file).

So -- I'd be rather skeptical about any Mattersight plan to grow beyond England. The new General Data Protection Regulation by its terms applies to all foreign companies processing data of EU residents (and that clearly includes Mr. Conway's company). In addition, the new law creates a two percent of annual global sales penalty for breaches/violations. Moreover, as a general rule, any processing of recorded telephone data will require a prior specific written notice to, and written informed consent from concerned EU individuals, for the processing of their data (other than in very limited exceptional cases, which would not seem to apply to Mattersight's business circumstances).

Of course, it all could change, in the coming months -- but for now, it doesn't look very good for Mattersight's recording of customer phone conversations, and then re-using the sliced and diced data to drive the behavioural analytics stuff it does with it, for the seller/client of Mattersight. At least this is true, under the current US-based, relatiely vague scheme under which Mattersight's business is presently-operated in the US and Canada. It is no defense under the new EU law, by the way, for a US company to say that it relied on its EU client to be sure that the data collected was compliant with EU processes when collected (as well as secured from hacking) -- and that alone could cost Mr. Conway up to two percent of his worldwide sales, for each serious breach/violation. Wow. 

As ever, we shall see. [Perhaps immodestly, I am quite pleased with how my graphic for this story turned out. Do click (at upper right) to enlarge it. Cheers!]