Children and data protection: Reflections on Safer Internet Day

Today marks the 19^th edition of Safer Internet Day, an online safety initiative celebrated across the globe to raise public awareness of the importance of online safety and to encourage a safer internet for all, especially children.

In many ways, the objectives of Safer Internet Day are aligned with certain aspects of the work of the DPC. As Ireland’s independent authority responsible for upholding the data protection rights of individuals, the DPC has a statutory obligation to promote public awareness and understanding of the risks, rules, safeguards and rights in relation to the processing of personal data, including in the online world, and this is particularly the case where children are concerned.

The rapidly evolving nature of the digital environment means that it is vital that children are equipped with the awareness, knowledge and skills needed to deal with the challenges and risks (including in connection with the use of their personal data) arising from their interaction with the latest apps and online and connected services. Although Safer Internet Day takes into account broader online safety concerns that fall outside the DPC’s remit, such as harmful online content and cyberbullying, it is clear that online safety and data protection are two sides of the same coin. For example, being aware of the risks of sharing your personal data with strangers online will inevitably support your online (and indeed real-life) safety.

The DPC’s work on children’s issues in 2021

An important overlap between Safer Internet Day and the work of the DPC is its particular focus on protecting children’s data in the digital environment. Last December, the DPC finalised its guidance for organisations on children’s data protection rights entitled “Children Front and Centre: Fundamentals for a Child-Oriented Approach to Data Processing”, or “the Fundamentals” for short. This guidance sets out 14 child-specific data protection-interpretative principles and a number of recommended measures that will enhance the level of protection afforded to children against the data protection risks posed to them in the online world. The Fundamentals were first unveiled in draft form at the end of 2020 and were then subject to an extensive public consultation in the first quarter of 2021 so that stakeholders from the public, private and civil society sectors could have an opportunity to comment and to make submissions on the draft guidance. The DPC also published a separate detailed report on responses to the consultation in November 2021. This approach, which built upon two previous public consultations (including a specific stream dedicated to hearing from children themselves) on children’s data protection rights in 2018-19, allowed the DPC to take account of as wide a range of views as possible in producing this guidance.

In addition to its work on the Fundamentals, the DPC is an active participant in many other initiatives at national and international level where children’s data protection issues intersect with online safety issues. The DPC sits on the National Advisory Council for Online Safety (NACOS) which advises the Irish Government on online safety issues. The DPC, as a member of the European Data Protection Board, is also involved in important work which has recently commenced on a set of EU guidelines on children’s data protection rights, which will seek to provide harmonisation in how children’s data protection issues are addressed across the EU. In 2021, the DPC also became a member of the Advisory Board of a new European Commission-funded project called euCONSENT. This project aims to create a safer digital world for children throughout the EU by developing a European-wide infrastructure to facilitate interoperable age verification and parental consent mechanisms.

DPC staff also routinely speak at external events and panel discussions on children’s online safety. Last May, the DPC appeared before the Joint Oireachtas Committee on Media, Tourism, Arts, Culture, Sport and the Gaeltacht to give evidence as part of the Committee’s pre-legislative scrutiny of the Online Safety and Media Regulation Bill. DPC staff also contributed several explanatory videos on data protection for the ISPCC’s “Digital Ready Hub”, an information portal on children’s online safety issues which was launched in April 2021.

Looking ahead

Turning to the future, the DPC will continue to prioritise its work on children’s data protection issues as reflected in its 2022-2027 regulatory strategy published at the end of last year, which lists the protection of children and vulnerable groups as a key policy priority. In the coming months, the DPC intends to publish a series of guidance materials specifically for children to explain basic principles of data protection and to assist children in exercising their data protection rights. Empowering children as data subjects to understand the risks, rules, safeguards and their rights in connection with their personal data is a crucial step in building a safer digital world.

The DPC looks forward to continuing its work in this important area and to its continued engagement with its stakeholders throughout 2022 and beyond.