Consent for processing children’s personal data in the EU: following in US footsteps?

Abstract

With the recent adoption of the General Data Protection Regulation (GDPR), the European Union (EU) assigned a prominent role to parental consent in order to protect the personal data of minors online. For the first time, the GDPR requires parental consent before information society service providers can process the personal data of children under 16 years of age. This provision is new for Europe and faces many interpretation and implementation challenges, but not for the US, which adopted detailed rules for the operators that collect personal information from children under the Children's Online Privacy Protection Act (COPPA) almost two decades ago. The article critically assesses the provisions of the GDPR related to the consent of minors, and makes a comparative analysis with the requirements stipulated in the COPPA in order to identify pitfalls and lessons to be learnt before the new rules in the EU become applicable.

Major Flaws in Minor Laws: Improving Data Privacy Rights and Protections for Children Under the GDPR

“…The GDPR is the European Union's first regulation to recognize children as a group requiring special data protection measures, and in providing such special protection, has introduced numerous changes from past data protection laws. 198 As discussed, one of these major changes takes effect where the processing of a child's data is based on the lawful basis of consent, and this change faces a number of practical challenges due to its recent enactment, lack of clarity and absence of uniformity for the Member States. 199…”

“…198 As discussed, one of these major changes takes effect where the processing of a child's data is based on the lawful basis of consent, and this change faces a number of practical challenges due to its recent enactment, lack of clarity and absence of uniformity for the Member States. 199…”

“…While the Regulation provides some guidance for what may constitute proper consent to process children's data, the rules for "verifiable parental consent" need significant clarification. 256 As currently enforced, the GDPR does not offer practical methods or solutions for gathering verifiable parental consent to process a child's data. 257…”

Εnhancing social networking in smart cities: Privacy and security borderlines

“…Moreover, the GDPR clearly defines the rights of individuals (subjects), which are: (i) notification of personal data breach, (ii) access to the data gathered and the manner and purpose of its use, (iii) right to delete data, (iv) data portability, and (v) data protection during collection and processing processes; while introduces and establishes Data Protection Officers (DPO), who are obliged to notify their data processing activities to local Data Protection Authorities (DPA) (EU GDPR Portal, 2018). The GDPR also places particular emphasis on the protection of minors by introducing for the first time the requirement of parental consent for the processing of personal data of children under the age of 16 (unless national laws set a lower age threshold which cannot be lower than 13) when information services are offered (Macenaite and Kosta, 2017).…”

Conducting research with school children and data in line with “ethical principles” lawyers at work in the ethics management of the H2020 mathisis project

“…2018 . “Children: a special case for privacy?” Intermedia 46:2 18-23; Milda Macenaite and Eleni Kosta. 2017 .…”