Subject: When Can
the Child Speak for Herself?
The Limits of
Parental Consent in Data Protection Law for Health Research | Medical Law
Review | Oxford Academic
Key points that I observed form this article
(I welcome feedback, particularly from those with practical experience)
‘Parental consent will always expire when the child
reaches the age at which they can consent for themselves. You [as data controller]
need therefore to review and refresh children’s consent at appropriate
milestones.’2
In the UK, the age of full majority is 18.3
However, an individual is entitled to exercise certain legal rights while still
a minor
The Gillick
Test in Healthcare - The case of Gillick
v West Norfolk & Wisbech Area Health Authority4
established that where a person under the age of 16 has reached sufficient
maturity to understand the nature and consequences of a proposed intervention,
and it is in their best interests to do so, then they can provide a valid legal
consent on their own behalf. Lord Fraser concluded that while a doctor should
always seek to persuade a child to tell a parent [it is up to the child]
If the processing of a child’s data began with the consent
of their legal representative, the child concerned may, on attaining majority,
revoke the consent. But if he wishes the processing to continue, it seems that
the data subject need give explicit consent wherever this is required.
You [as data controller] should consider whether the
individual child has the competence to understand and consent for themselves
(the ‘Gillick competence test’). [And presumably consider that as part of DPIA
and Privacy by Default/Design]
‘The core legal principle is that of the best interest of
the child.’28 As in the context of healthcare, parents continue to
have responsibility—where necessary, expressed through parental consent—to act
in a child’s best interest.29
There may be limited circumstances in which a data
controller considers it appropriate to continue to process data relating to a
child past the age of 16, and on the basis of a parental consent. These
circumstances would most likely be limited to those where the following
considerations apply:
1.
the requirements regarding consent were met at
the time that consent was originally given;
2.
there is no reason to rebut the presumption
that, in line with previous parental consent, it remains in the best interest
of the child that the processing continue; and
3.
it would be ‘fair’ to rely upon the alternative
legal basis in the circumstances.
Whether it would be ‘fair’ requires consideration of all
material factors including, but not limited to,
1.
whether it is clear to the data subject, ie the
child, that she has rights in relation to the processing, including the right
to object;
2.
the extent to which the child was originally
involved in the original decision to provide consent, and whether she assented
to the processing;
3.
the extent to which considerations of ‘best
interest’ are engaged and favour processing; and
4.
evidence from any context in which the child has
begun to exercise her own data autonomy, for example, through social media or
other means that suggest evidence of growing maturity.
