Data Protection Commission Ireland has issued a report on the responses it received to its public consultation on its guidance on children’s rights.
Of particular note is the careful consideration the commission gave the public input, as well as the time it took to thoughtfully respond.
Some key points:
On children as unique population:
“The DPC considers it critical that children are recognised as a distinct cohort of users of services, especially in the online world, who are data subjects in their own right and who merit specific protection…it is vital that organisations accept that the best interests of the child and the specific requirements demanded by the GDPR for the protection of children’s personal data are a crucial and necessary component of running a business that profits or benefits from having children as a central cohort of its user population.”
“It is not clear to the DPC why there needs to be a trade-off between empowering and protecting children in the digital environment. It is possible to provide online services that empower children and are attractive to them but which also protect their personal data to the highest standards.”
“International and EU law make it manifestly clear that the best interests of the child should be paramount in any decision-making concerning the processing of children’s data. In particular, this means that the interests and/ or fundamental rights and freedoms of child data subjects should always take precedence over the rights and interests of an organisation which is processing children’s personal data for commercial purposes.”
On Legitimate Interests as legal basis:
“The purpose of the “Zero interference” Fundamental is not to prevent reliance on Article 6(1)(f) as a legal basis for processing but to ensure that where this legal basis is relied on, that organisations are carrying out meaningful and honest assessments of the risks and impacts upon child users and are truly putting the best interests of the child before their own commercial interests where the assessment requires this.”
“Profiling for marketing or advertising purposes will generally not align with the position that there should be zero interference with the best interests of the child in the processing of their personal data unless the organisation can demonstrate otherwise…this is in line with the UN Committee on the Rights of the Child in their General Comment No. 25.”
On Data Protection Impact Assessments:
“When it comes to DPIAs that specifically assess processing operations involving children’s personal data, the DPC considers it necessary that organisations consult with child development and child safety experts to ensure they have considered the cumulative risk that could potentially be posed to children as part of their processing operations.”