GDPR, consent, ISS and age under 13

[Ditto]

I'm trying to clarify the answer to a question around when parental consent is required to process a child's data. The particular topic that I'm struggling to nail down is the importance of the age 13 breakpoint. ICO reference age 13 many times. A couple of examples:

 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-uk-gdpr/what-are-the-rules-about-an-iss-and-consent/

 

https://ico.org.uk/for-organisations/guide-to-data-protection/key-dp-themes/children/

 

Just search for "13" to go to the relevant section.

 

In both instances, it refers to "Information Society Service" (ISS) which in lay terms I understand means online services.

 

The piece I am struggling to get absolute clarity on, is whether the age 13 is relevant to just ISS or whether it's a universal (well England) truth for data protection. For example, if we run an in person service to a group of children in school, some under 13, some over, what's the position on the requirement to seek parental consent to process their data.

 

For this scenario, I'm assuming 'consent' has been chosen as the legal basis for processing. In the scenarios I'm looking at, I'm not convinced that consent is always the best legal basis, but I'll save that topic for another time!

[ChrisH]

13 is mentioned as they are usually the age limits on social media etc. Model documents for policies also can state that at 12 and above children are generally capable of understanding consenting to the processing of their data in other ways but this can also be reviewed on a case by case basis. A minefield for sure.

[Ditto]

Yes, agreed, I thought is was mostly targeted at online social media, which are online, but then would running online support webinars count? I have some awareness of the competency of understanding, and sometimes see the Gillick competency test mentioned. But historically, that's focused on health topics, not GDPR. I did find one wiki article that is interesting to see how young people's rights have changed over time and circumstances. For example it can differ for criminal law, data protection law, health care laws and and sexual consent law. Even allowing for the changing times, the 17th century statement is shocking - see https://en.wikipedia.org/wiki/Timeline_of_young_people%27s_rights_in_the_United_Kingdom

[synaesthesia]

Age isn't the be all and end all - parental responsibility however is. Not just parental - for example, see powers of attorney which you may need for an elderly or infirm relative who may be the same age or older than you.

[GrumbleDook]

I would strongly recommend reading the original report from the Digital Futures Commission, looking at the use of data within education - https://digitalfuturescommission.org.uk/wp-content/uploads/2021/06/Governance-of-data-for-children-learning-Final.pdf, reading with an open mind and remembering it is just a starting point.

 

There was a follow up roundtable, and the report from this is a significant improvement - https://digitalfuturescommission.org.uk/wp-content/uploads/2021/11/Roundtable-report-25112-final.pdf

 

Also have a look at the FAQs for schools and EdTech providers around the Age Appropriate Design Code (aka the Children's Code) - https://ico.org.uk/for-organisations/childrens-code-hub/additional-resources/faqs-for-education-technologies-edtech-and-schools/

 

The ICO also has other information about children and their rights - https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-uk-gdpr/what-rights-do-children-have/

 

In short, Consent is not a common lawful basis within schools except for some specific areas, often governed by other legislation (e.g. Protection of Freedoms Act 2012 for biometrics).

Where Consent is required as covered purely under GDPR (and not other legislation) then the above link from ICO about rights of the child also covers how it applies to parental responsibility.

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/what-is-valid-consent/#what9 also gives details on what is valid consent where children are concerned.

 

We should also not confuse Consent (article 6 lawful basis) and Explicit Consent (article 9 lawful basis for processing special category data), even though the two do tend to go hand in hand.

 

In short, only use Consent where it is the most appropriate lawful basis. If you do need it, then look at where parental responsibility is expected and where a child's competence is to be considered. Also remember that rights are not absolute.

Also consider when you are being asked to gather consent to use particular solutions because a vendor says you must ... you (the school as the Data Controller) decide the lawful basis, so is it the right one for you?

 

If you are looking specifically for what an ISS is? https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-uk-gdpr/what-are-the-rules-about-an-iss-and-consent/#a3 gives a details definition. If what is being offered by the school is not part of the core aspect of the school (delivering the curriculum, pastoral and well-being, or for the management and operation of the school ... basically, look at what comes under OFSTED framework) then consider whether Legitimate Interest is relevant (and complete a Legitimate Interest Assessment to identify the balance between the person's rights and the organisation's needs/delivery).

 

Not a complete answer for you, as the school needs to decide that with the support of your DPO. Hopefully it gives you a significant amount of helpful information though.