Children have the same rights as adults over their personal data. These are set out in Chapter III and VIII of the GDPR and are also listed below. For more detailed information about how these rights apply to all data subjects, please refer to our Guide to the GDPR. Where these provisions raise child specific issues these are covered below or elsewhere in our pages on Children and the GDPR.
All data subjects, including children have the right to:
A child may exercise the above rights on their own behalf as long as they are competent to do so. In Scotland, a person aged 12 or over is presumed to be of sufficient age and maturity to be able to exercise their data protection rights, unless the contrary is shown. This presumption does not apply in England and Wales or in Northern Ireland, where competence is assessed depending upon the level of understanding of the child, but it does indicate an approach that will be reasonable in many cases. A child should not be considered to be competent if it is evident that he or she is acting against their own best interests.
If you have already decided that a child is competent to provide their own consent then it will usually be reasonable to assume they are also competent to exercise their own data protection rights.
If a child is competent then, just like an adult, they may authorise someone else to act on their behalf. This could be a parent, another adult, or a representative such as a child advocacy service, charity or solicitor.
Even if a child is too young to understand the implications of their rights, they are still their rights, rather than anyone else’s such as a parent or guardian.
You should therefore only allow parents to exercise these rights on behalf of a child if the child authorises them to do so, when the child does not have sufficient understanding to exercise the rights him or herself, or when it is evident that this is in the best interests of the child.
This applies in all circumstances, including in an online context where the original consent for processing was given by the person with parental responsibility rather than the child.
An adult with parental responsibility may seek to exercise any of the child’s rights on their behalf.
If you are satisfied that the child is not competent, and that the person who has approached you holds parental responsibility for the child, then it is usually appropriate to let the holder of parental responsibility exercise the child’s rights on their behalf. The exception to this is if, in the specific circumstances of the case, you have evidence that this is not in the best interests of the child.
If you are confident that the child can understand their rights, then you should usually respond directly to the child. You may, however, allow the parent to exercise the child’s rights on their behalf if the child authorises this, or again if it is evident that this is in the best interests of the child.
What matters is whether the child is able to understand and deal with the implications of exercising their rights. So for example, does the child understand what it means to request a copy of their data and how to interpret the information they receive as a result of doing so? When considering borderline cases, you should take into account, among other things: