GDPR When Can the Child Speak for Herself?

Subject: When Can the Child Speak for Herself?

The Limits of Parental Consent in Data Protection Law for Health Research | Medical Law Review | Oxford Academic

https://academic.oup.com/medlaw/advance-article/doi/10.1093/medlaw/fwx052/4621374

Key points that I observed form this article 

(I welcome feedback, particularly from those with practical experience)

‘Parental consent will always expire when the child reaches the age at which they can consent for themselves. You [as data controller] need therefore to review and refresh children’s consent at appropriate milestones.’²

In the UK, the age of full majority is 18.³ However, an individual is entitled to exercise certain legal rights while still a minor

The Gillick Test in Healthcare - The case of Gillick v West Norfolk & Wisbech Area Health Authority⁴ established that where a person under the age of 16 has reached sufficient maturity to understand the nature and consequences of a proposed intervention, and it is in their best interests to do so, then they can provide a valid legal consent on their own behalf. Lord Fraser concluded that while a doctor should always seek to persuade a child to tell a parent [it is up to the child]

If the processing of a child’s data began with the consent of their legal representative, the child concerned may, on attaining majority, revoke the consent. But if he wishes the processing to continue, it seems that the data subject need give explicit consent wherever this is required.

You [as data controller] should consider whether the individual child has the competence to understand and consent for themselves (the ‘Gillick competence test’). [And presumably consider that as part of DPIA and Privacy by Default/Design]

‘The core legal principle is that of the best interest of the child.’²⁸ As in the context of healthcare, parents continue to have responsibility—where necessary, expressed through parental consent—to act in a child’s best interest.²⁹

There may be limited circumstances in which a data controller considers it appropriate to continue to process data relating to a child past the age of 16, and on the basis of a parental consent. These circumstances would most likely be limited to those where the following considerations apply:

1.      the requirements regarding consent were met at the time that consent was originally given;

2.      there is no reason to rebut the presumption that, in line with previous parental consent, it remains in the best interest of the child that the processing continue; and

3.      it would be ‘fair’ to rely upon the alternative legal basis in the circumstances.

Whether it would be ‘fair’ requires consideration of all material factors including, but not limited to,

1.      whether it is clear to the data subject, ie the child, that she has rights in relation to the processing, including the right to object;

2.      the extent to which the child was originally involved in the original decision to provide consent, and whether she assented to the processing;

3.      the extent to which considerations of ‘best interest’ are engaged and favour processing; and

4.      evidence from any context in which the child has begun to exercise her own data autonomy, for example, through social media or other means that suggest evidence of growing maturity.