DPC publishes final version of Children’s “Fundamentals”

17th December 2021

The Data Protection Commission (DPC) has today published the final version of its guidance “Children Front and Centre: Fundamentals for a Child-Oriented Approach to Data Processing” (the Fundamentals). This is the culmination of an intensive project over the last 3 years which has involved 3 separate stakeholder consultation processes (including a direct consultation with children), engagement with experts in the area of children’s rights, expansive research and a two-stage drafting process. The Fundamentals introduce child-specific data protection interpretative principles and recommended measures that will enhance the level of protection afforded to children against the data processing risks posed to them by their use of/ access to services in both an online and offline world. The Fundamentals will also assist organisations that process children’s data by clarifying the principles, arising from the high-level obligations under the GDPR, to which the DPC expects such organisations to adhere.

Work on the Fundamentals began in late 2018 with the launch of a two-streamed public consultation. Stream 1 sought the views of adult stakeholders including parents, educators, children’s rights organisations and industry, amongst others, on core data protection issues pertaining to children by means of a traditional online consultation document. Stream 2 sought to engage directly with children and young people in the classroom through a specially designed consultation process.

Following several months of in-depth academic and policy research and legal analysis, as well as further engagement with key stakeholders in the area of children’s rights, in December 2020, the DPC published a draft version of the Fundamentals and ran a public consultation on the document between 18 December 2020 and 31 March 2021, to give stakeholders a final opportunity to present their views. In total, 27 submissions were received in response to this consultation. Participating stakeholders came from a wide range of sectors, including technology and social media companies, children’s rights charities, public sector bodies and trade associations. A detailed report on the submissions received in response to this public consultation was published in November 2021, along with the DPC’s responses to the various thematic issues which emerged.

This final version of the Fundamentals rests heavily on significant consultations, expert input and stakeholder submissions, including from children themselves, and is an important step in terms of achieving the higher standards of protection for children’s personal data required under the GDPR. The DPC is determined to drive a transformation in how the personal data of children is handled and the Fundamentals represent an important stepping stone in this evolution.

The Fundamentals have immediate application and operational effect, now forming the basis for the DPC’s approach to supervision, regulation and enforcement in the area of processing of children’s personal data. The full guidance document can be found here.

Work to date on the Fundamentals for a Child-Oriented Approach to Data Processing: