menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Austria) language
Contact our local member in Austria mail_outline
Visit the website of Geistwert account_balance

arrow_backPrevious Article
Article 8
Next Articlearrow_forward

Conditions applicable to child's consent in relation to information society services

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 8 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 8 keyboard_arrow_up

Articles related to article 8

Key words related to article 8

Show the recitals of the Regulation related to article 8 keyboard_arrow_down Hide the recitals of the Regulation related to article 8 keyboard_arrow_up

(38) Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to a child. The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child.

(47) The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing. Given that it is for the legislator to provide by law for the legal basis for public authorities to process personal data, that legal basis should not apply to the processing by public authorities in the performance of their tasks. The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.

(58) The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising. Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand.

There is no recital in the Directive related to article 8.

The GDPR

According to recital 38 of the Regulation, children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. The use of personal data relating to children for purposes of marketing or creating personal or user profiles and the collection of data relating to children during the use of services provided directly to a child are particularly concerned.

Therefore, Article 8 of the Regulation provides that the processing of data relating to a child within a direct offer of information society services (see Article 1er, 2 of Directive 98/34EC of 22 June 1998) is lawful for children aged at least 16 years. With respect to children under the age of 16, the controller must obtain the consent to the processing from the holder of parental responsibility.

However, the Regulation allows the Member States to authorise the processing of data relating to a child under 16 years for these purposes without the authorization of the holder of parental responsibility, as long as this age is not less than 13 years.

In other words, children under the age of 16 years must get permission from the parents to open an account on social media such as Facebook, Instagram , or Snapchat, as is already the case in most of the countries of the Union at the present time, unless the Member State has provided a lower age whицх cannot, in any event be under 13 years of age (see Press release of the Committee on Civil Liberties, Justice and Home Affairs of 17 December 2015, REF. : 20151217IPR08112).

Initially, Parliament's negotiators wanted an age limit of 13 years across Europe. However, the Member States did not reach a consensus on this age. Accordingly, the Member States may set their own limits as long as they are neither less than 13 years, nor more than 16 years. This flexibility was introduced at the insistence of the Member States, so that they can keep the limits that they already apply.

It is up to the controller to make reasonable efforts to ensure that the consent is given by the holder of parental responsibility, given the technology available.

Finally, the provision specifies that it does not affect national law in contractual matters which would include specific rules on the validity, the training or the effects of a contract in respect of a child.

The Directive

Neither the Directive nor the analysed national laws contained such a provision.

Potential issues

The validity of the child’s consent over the Internet raises an obvious problem. Not only because the free and informed nature of such consent can often be discussed, but also its validity may vary from one state to another. Article 8 seems to take this into account and obviously wants to tackle the problem.

There are no definitions (of the child and the holder of parental responsibility) while they were present in the first version of the Regulation.

Ultimately, such a provision is intended to prohibit the controller to base processing on the consent of children under the age of 16 , or under  the age of 13 according to the law of the Member State concerned.

This flexibility recognized by Member States goes against the will of harmonization of the rules at European level and may cause legal uncertainty in the responsibility of the controllers who will have to take into account the specificities of each Member State in order to ensure the legality of their processing.

arrow_back Previous Article • Article 8 • Next Article arrow_forward
arrow_back Previous Article • Article 8 Next Article arrow_forward

Summary

European Union

European Union

European Data Protection Board (EDPB)

Guidelines on consent under Regulation 2016/679 - 5/2020 (4 may 2020)

These Guidelines provide a thorough analysis of the notion of consent in Regulation 2016/679, the General Data Protection Regulation (hereafter: GDPR). The concept of consent as used in the Data Protection Directive (hereafter: Directive 95/46/EC) and in the e-Privacy Directive to date, has evolved. The GDPR provides further clarification and specification of the requirements for obtaining and demonstrating valid consent. These Guidelines focus on these changes, providing practical guidance to ensure compliance with the GDPR and building upon the Article 29 Working Party Opinion 15/2011 on consent. The obligation is on controllers to innovate to find new solutions that operate within the parameters of the law and better support the protection of personal data and the interests of data subjects.

Consent remains one of six lawful bases to process personal data, as listed in Article 6 of the GDPR.2 When initiating activities that involve processing of personal data, a controller must always take time to consider what would be the appropriate lawful ground for the envisaged processing.

Generally, consent can only be an appropriate lawful basis if a data subject is offered control and is offered a genuine choice with regard to accepting or declining the terms offered or declining them without detriment. When asking for consent, a controller has the duty to assess whether it will meet all the requirements to obtain valid consent. If obtained in full compliance with the GDPR, consent is a tool that gives data subjects control over whether or not personal data concerning them will be processed. If not, the data subject’s control becomes illusory and consent will be an invalid basis for processing, rendering the processing activity unlawful.

The existing Article 29 Working Party (WP29) Opinions on consent4 remain relevant, where consistent with the new legal framework, as the GDPR codifies existing WP29 guidance and general good practice and most of the key elements of consent remain the same under the GDPR. Therefore, in this document, the EDPB expands upon and completes earlier Article 29 Working Party Opinions on specific topics that include reference to consent under Directive 95/46/EC, rather than replacing them.

As the WP29 stated in its Opinion 15/2011 on the definition on consent, inviting people to accept a data processing operation should be subject to rigorous requirements, since it concerns the fundamental rights of data subjects and the controller wishes to engage in a processing operation that would be unlawful without the data subject’s consent.

The crucial role of consent is underlined by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. Furthermore, obtaining consent also does not negate or in any way diminish the controller’s obligations to observe the principles of processing enshrined in the GDPR, especially Article 5 of the GDPR with regard to fairness, necessity and proportionality, as well as data quality. Even if the processing of personal data is based on consent of the data subject, this would not legitimise collection of data, which is not necessary in relation to a specified purpose of processing and be fundamentally unfair. Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.

Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.

With regard to the existing e-Privacy Directive, the EDPB notes that references to the repealed Directive 95/46/EC shall be construed as references to the GDPR.

This also applies to references to consent in the current Directive 2002/58/EC, as the ePrivacy Regulation will not (yet) be in force from 25 May 2018. According to Article 95 GDPR, additional obligations in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks shall not be imposed insofar the e-Privacy Directive imposes specific obligations with the same objective. The EDPB notes that the requirements for consent under the GDPR are not considered to be an ‘additional obligation’, but rather as preconditions for lawful processing. Therefore, the GDPR conditions for obtaining valid consent are applicable in situations falling within the scope of the e-Privacy Directive.

Lien

Retour au sommaire
arrow_back Previous Article • Article 8 Next Article arrow_forward
Retour au sommaire
arrow_back Previous Article • Article 8 Next Article arrow_forward
Regulation
1e 2e

Art. 8

1.   Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.

2.   The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.

3.   Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.
1st proposal close

Art. 8

1. For the purposes of this Regulation, in relation to the offering of information society services directly to a child, the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child's parent or custodian. The controller shall make reasonable efforts to obtain verifiable consent, taking into consideration available technology.

2. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.

3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria and requirements for the methods to obtain verifiable consent referred to in paragraph 1. In doing so, the Commission shall consider specific measures for micro, small and medium-sized enterprises.

4. The Commission may lay down standard forms for specific methods to obtain verifiable consent referred to in paragraph 1. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
2nd proposal close

Art. 8

1. Where Article 6 (1)(a) applies, in relation to the offering of information society services directly to a child, the processing of personal data of a child (...) shall only be lawful if and to the extent that such consent is given or authorised by the holder of parental responsibility over the child or is given by the child in circumstances where it is treated as valid by Union or Member State law.

1a. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.

2. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.

3. (...)

4. (...)

 
Directive close

There is no specific provision
Austria
compare_arrows
visibility Old law

Scope of application and implementing provision

§ 4 DSG

[...]

(4) In the case of an offer of information society services directly to a child, consent to the processing of the personal data of a child pursuant to Article 6 para. 1 (a) of the General Data Protection Regulation shall be lawful where the child is at least 14 years old.

[...]
Old law close

No (special) provisions in Austria before May 25, 2018.
Spain close

Article 13. Consent for the processing of the data of minors.- Royal Decree 1720/2007 Implementing Organic Law 15/1999 on the Protectiopn of Personal Data

1. Data pertaining to data subjects over fourteen years of age may be processed with their consent, except in those cases where the law requires the assistance of parents or guardians in the provision of such data. The consent of parents or guardians shall be required for children under fourteen years old.

2. Under no circumstances may data be collected from the minor regarding information about any other member of the family unit, or about its characteristics, such as data relating to the professional activity of the parents, financial information, sociological or any other such data, without the consent of the persons to whom such data refer. The aforesaid notwithstanding, data regarding the identity and address of the father, mother or guardian may be collected for the sole purpose of obtaining the authorisation set out in the previous subsection.

3. When processing refers to the data of minors, the information aimed at them shall be expressed in easily understandable language, with express indication of the provisions of this Article.

4. The data controller is responsible for setting up the procedures that guarantee that the age of the minor and authenticity of the consent given by the parents, guardians or legal representatives have been effectively checked.
arrow_back Previous Article • Article 8 Next Article arrow_forward
close

2016 - www.itiplaw.eu.