5Rights Foundation

February 2024 Response to Call for Evidence Report on the General Data Protection Regulation Introduction The 5Rights Foundation welcomes the opportunity to comment on the implementation of the General Data Protection Regulation (GDPR) and its application across Member States. The rights of the child, as recognised by the UN Convention on the Rights of the Child and elaborated as regards the digital environment in UNCRC General comment No. 25 (GC25), must be a key consideration as well as a priority informing the implementation and application of the GDPR. This document provides an overview of 5Rights’ considerations on how the GDPR can better protect and promote children’s rights in the digital environment.

…of 5Rights’ considerations on how the GDPR can better protect and promote children’s rights in the digital environment. The principles and provisions of GDPR interpreted together with established children’s rights law, set out strong and unambiguous requirements for the protection of children’s personal data. Services must recognise children using or likely to use their services and ensure that any risks to their rights and best interests are assessed and mitigated, by design and default. Children do merit special protections for their personal data, and the above overview of child data protection regimes provides a comprehensive and strongly consensual guidebook to what those protections should be.

…data protection regimes provides a comprehensive and strongly consensual guidebook to what those protections should be. 5Rights develops policy, creates innovative frameworks, develops technical standards, publishes research, challenges received narratives and ensure that children's rights and needs are recognised and prioritised in the digital world. While 5Rights works exclusively on behalf of and with children and young people under 18, our solutions and strategies are relevant to many other communities. Our focus is on implementable change and our work is cited and used widely around the world. We work with governments, inter- governmental institutions, civil society, academics, businesses, and children, so that digital products and services can have positive impact on their lived experiences. General comment Children represent one in three internet users worldwide.

…positive impact on their lived experiences. General comment Children represent one in three internet users worldwide. The digital world is not optional for them. It is where they access education, health services and entertainment, build and maintain their relationships, and engage in civic and social activities. Children do not only use services explicitly targeted or designed for them, so they must be protected wherever they are in practice, not only where government, companies or parents and carers might wish them to be. The protection of children as well as the promotion of their rights, wherever and whenever they are online, must be a priority. Data drives many norms of the digital world, and the way children’s data are collected, processed and shared impacts every aspect of their online experience.

…world, and the way children’s data are collected, processed and shared impacts every aspect of their online experience. Recital 38 of the EU General Data Protection Regulation (GDPR) stipulates that “children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data”, reflecting the vulnerabilities associated with their age and developmental capacities, as well as their established rights. Ref. Ares(2024)976156 - 08/02/2024 5RIGHTS Response to Call for Evidence: Report on the GDPR February 2024 2 The adoption of the GDPR set a new global norm and has influenced regulatory reform and inspired new laws around the world.

…adoption of the GDPR set a new global norm and has influenced regulatory reform and inspired new laws around the world. The European Data Protection Board (EDPB) has developed a series of Guidelines on specific aspects of GDPR, including as regards the protection of children’s data, which consistently reiterate the need to apply additional safeguards for children.1 What these additional safeguards should be and how, more broadly, GDPR should be interpreted in light of the established legal rights and needs of children is yet to be specified at the EU level. However, several European Data Protection Authorities (DPAs) and other authorities have drafted guidelines for children’s data protection, inspiring similar efforts around the world, including in Australia and the US.

…for children’s data protection, inspiring similar efforts around the world, including in Australia and the US. Based on the principles and provisions enshrined in GC25, these instruments recognise and consider children’s specific rights, needs and vulnerabilities in data protection. Examples include notably the Irish Data Protection Commission’s Fundamentals for a Child-Oriented Approach to Data Processing;2 the Swedish Stakeholder Guide on Rights of Children and Young People on Digital Platforms;3 the Dutch Code for Children’s Rights;4 the French Data Protection Authority’s Recommendations on the Digital rights of Children,5 as well as the ICO Children’s Code.6 These instruments are crucial to ensure that children’s additional rights are not only formally recognised but also properly understood and respected by companies that process children’s data.

…are not only formally recognised but also properly understood and respected by companies that process children’s data. The swift adoption by the European Data Protection Board of guidelines on children’s data, based on the foregoing principles, instruments and internationally recognised standards, would ensure further consistency and coherency in the application of GDPR as regards children’s data across the EU, as well as foster the protection of children’s rights in the digital environment. As a broader international policy and regulatory landscape governing children’s rights in the digital environment takes shape, more concrete and precise guidance on how to apply the GDPR to children’s data and thus better protect their privacy by design and by default, would reinforce efforts to increase children’s safety in the digital environment.

…privacy by design and by default, would reinforce efforts to increase children’s safety in the digital environment. Therefore, we strongly believe that this matter should be considered a priority in the implementation and enforcement of the GDPR.

…strongly believe that this matter should be considered a priority in the implementation and enforcement of the GDPR. This is even more urgent considering the increasing challenges to the protection and fulfilment of children’s rights in the digital environment, notably related to the uptake of artificial intelligence systems7 or education technology.8 1 Cfr Guidelines 05/2020 on consent under Regulation 2016/679; Guidelines 3/2022 on Dark patterns in social media platform interfaces: How to recognise and avoid them; Guidelines 10/2020 on restrictions under Article 23 GDPR; Guidelines 08/2020 on the targeting of social media users; Guidelines 4/2019 on Article 25 Data Protection by Design and by Default 2 Available at: https://www.dataprotection.ie/en/dpc-guidance/fundamentals-child-oriented-approach- data-processing 3 Available at:…

…early adoption of Gen AI; Common Sense Media (2023) Parents and students are optimistic about AI, but parents have a lot to learn to catch-up to their kids 8 Cfr European Commission (2019) 2nd Survey of schools: ICT in Education; Norwegian Consumer Council (2023) Ghost in the machine – Addressing the consumer harms of generative AI; UNESCO (2023) An ed- tech tragedy?

Ghost in the machine – Addressing the consumer harms of generative AI; UNESCO (2023) An ed- tech tragedy? Educational technologies and school closures in the time of COVID-19; UNESCO (2023) Technology in Education: a tool on whose terms?; Digital Future Commission (2023) A Blueprint for Education Data 5RIGHTS Response to Call for Evidence: Report on the GDPR February 2024 3 We therefore invite the European Commission and European Data Protection Board to carefully consider 5Rights report “Approaches to Children’s Data Protection”,9 detailing notably: all the pertinent elements of children’s rights underpinning regulatory policy in the digital environment, from GC25 and other UN documents to the EU or Council of Europe’s strategies on the rights of the child; legislative and policy initiatives for children's data protection, both based on GDPR like the UK’s ICO Age Appropriate Design…

43 → 12

originalus šaltinis (PDF) ↗