Feeds

Children should get keys to their data when they come of age

Data protection working party weighs in

Boost IT visibility and business value

Companies processing children's data may need explicit consent directly from a child to continue using it once that child reaches maturity, Europe's privacy officials have said. The child may also revoke consent given earlier by a parent or guardian.

The Article 29 Working Party, a committee of European countries' data protection officials, has said when a child becomes mature enough to make their own decisions anyone processing their sensitive data must ensure they have the child's permission and not just that of the child's representative.

"Sensitive personal data" is defined in data protection legislation and includes information about someone's ethnic origin, religious beliefs, health, and more.

The Working Party has outlined the requirement in its guide (pdf) to children's data protection. It said data protection policies for children must be sensitive to the point at which a child is mature enough to make his or her own decisions, and must respect those.

"If the processing of a child's data began with the consent of their representative, the child concerned may, on attaining majority, revoke the consent," said the guidance. "But if he wishes the processing to continue, it seems that the data subject need give explicit consent wherever this is required.

"For example, if a representative has given explicit consent to the inclusion of his child in a clinical trial, then upon attaining majority, the controller must make sure he still has a valid basis to process the personal data of the data subject. He must in particular consider obtaining the explicit consent of the data subject himself in order for the trial to continue, because sensitive data are involved," said the Working Party.

The Working Party also warned of the dangers posed to children's privacy by new digital recording technologies such as the video recording features on many models of mobile phones. It said schools must take responsibility for making children aware of one another's rights to privacy.

"Schools should warn their students that unrestrained circulation of video recordings, audio recordings and digital pictures can result in serious infringements of the data subjects’ right to privacy and personal data protection," it said.

The guidance also said any organisation that holds data on a child must be more than usually vigilant about deleting that data because it will lose its relevance more quickly than data about an adult.

"Because children are developing, the data relating to them change, and can quickly become outdated and irrelevant to the original purpose of collection. Data should not be kept after this happens," said the guidance.

The Working Party also advised that schools be particularly careful about collecting data on children, and said that children should be able to opt out of biometric access systems which are increasingly used in schools to control access to the school. It should be simple for children or their representatives to object and be issued with an access card instead, it said.

The guidance also warned schools about their use of websites. It said private information posted online should be protected, and that schools should exercise caution when using photographs of pupils, obtaining their permission first.

Copyright © 2008, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Build a business case: developing custom apps

More from The Register

next story
Hello, police, El Reg here. Are we a bunch of terrorists now?
Do Brits risk arrest for watching beheading video nasty? We asked the fuzz
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
UK government accused of hiding TRUTH about Universal Credit fiasco
'Reset rating keeps secrets on one-dole-to-rule-them-all plan', say MPs
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Yes, but what are your plans if a DRAGON attacks?
Local UK gov outs most ridiculous FoI requests...
EU justice chief blasts Google on 'right to be forgotten'
Don't pretend it's a freedom of speech issue – interim commish
Felony charges? Harsh! Alleged Anon hackers plead guilty to misdemeanours
US judge questions harsh sentence sought by prosecutors
This'll end well: US govt says car-to-car jibber-jabber will SAVE lives
Department of Transportation starts cogs turning for another wireless comms standard
Munich considers dumping Linux for ... GULP ... Windows!
Give a penguinista a hug, the Outlook's not good for open source's poster child
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.