The time before the GDPR enters into force is relentlessly ticking away. Do not worry, in this post I am neither going to paint scary pictures of what companies will have to face, nor make a list of what you should forget about when this law is enacted; I will “just” focus on the processing of personal data of children, namely the Article 8 that regulates the conditions for granting consent with processing of the child’s personal data in connection with information society services.
“Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorized by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.”
As shown, for example, by the experience with the INSAFE network and the workshop organized by the Czech Data Protection Society in December 2017, the practical implementation of this article brings a number of problems.
The most important thing is, above all, the question of how to “make reasonable efforts” to verify that the person is actually a parent (or a legal guardian). Also challenging will be to set the age limit, which I would like to address in detail and point out to a possible problem for the Czech Republic.
As a typically European compromise solution satisfying all Member States, it has been agreed that the “basic” lower age limit is 16 years, but states can reduce it to 13 years in their national laws. The following infographics show the direction in which individual countries are moving (updated February 12, 2018 about new information from Latvia).
In the draft of the Czech law on the processing of personal data, the possibility of reducing the age limit to 13 years is being considered, although there are voices (during the commentary procedure, the change the age limit was required e.g. by the Supreme Court, the Ministry for Regional Development, the Ministry of Agriculture, the Supreme Audit Office and three regions – Ústí, Vysočina and Zlín) asking whether it should rather be 15 years, i.e. the age when the child gains some rights and (partial) criminal liability, or 16 years.
Here, it is important to note that even children under the age of 15 can now engage in a variety of legal actions through the Internet, such as concluding a purchase contract in the e-shop, not to mention the use of social networks. And when doing many of these things, with a few exceptions like purchasing alcoholic beverages or tobacco products, giving one’s age is not required. Minors can thus buy an MP3 player, a ticket for a festival and such online with hardly any difficulties.
In the Czech Republic, however, it may very well happen that for some time the age limit for free use of the Internet (or information society services) will eventually be not 13 or 15 years, but the highest possible, which is 16 years of age. This might happen very easily – if our legislators do not manage to discuss the aforementioned law on the protection of personal data in time. Until it is published in the Collection of Laws, from May 28, 2018, the Czech Republic (and other states without their own relevant legislation) will be subject to the “basic” limit, which is 16 years of age.
We will thus get a paradoxical situation where come their 15th birthday, children will be able to buy things online, drive a small motorbike, have sex, or be responsible for public transport fare evasion, but will not be able to set up a Facebook or Instagram account.
If we don’t want to get to that point, the Ministry of the Interior needs to “push” this law as soon as possible to the next step of the legislative process, and then it has to be dealt with by the Senate as quickly as possible, so it can be published in the Collection of Laws before May 25, 2018. Given how long it usually takes for new laws to get approved, there is not much time left.