By José-Luis Piñar Mañas

Children's Data Protection in Europe: A New Document from WP 29

The Article 29 Working Party has published its Working Document 1/2008 on the protection of children's personal data (General guidelines and the special case of schools), WP 147, of February, 18, 2008 (http://ec.europa.eu/ justice_home/ fsj/privacy/index_en.htm). The document was prepared with the highly relevant participation of the Portuguese National Commission of Data Protection.

The purpose of the document is to analyse the general principles relevant to the protection of children's data, and to explain their relevance in a specific critical area, namely that of school data, and should be seen in the context of the general initiative of the European Commission described in its communication "Towards an EU strategy on the Rights of the Child."

The core legal principle is that of the best interests of the child. On this issue, it must be remembered that the rights to data protection belong to the child, and not to their representatives, who simply exercise them.

The document provides detailed analyses of how children's development must be taken into account in relation, for example, to expression of their consent, or to their right to be consulted. In particular, it analyses the cases in which it is necessary to perform such processing of children's data, as in the cases of health protection or the right to education.

It also thoroughly analyses application to minors of the data protection principles regulated in Directive 95/46/CE; in particular:

   1. Data Quality, and that means fairness (the duty to process personal data in accordance with the principle of fairness (Art. 6a) must be interpreted strictly when it concerns a child), proportionality and relevance of data (controllers should pay special attention to the situation of the child, as they must respect their best interests at all times. In view of children's constant development, data controllers will need to pay particular attention to the duty to keep personal data up-to-date), and data retention (one must keep in mind the "droit a  l'oubli" which covers any data subject including, especially, children).
   2. Legitimacy (with a detailed analysis of the cases that legitimate data processing, not only unambiguous consent, but also the authorisations foreseen in the laws or those arising from establishment of contractual relations).
   3. Data security (data controllers and processors should be aware that children's data require a high level of protection).

Special attention is also dedicated to the rights of data subjects:

   1. Right to be informed (special emphasis should be put on giving layered notices based on the use of simple, concise and educational language that can be easily understood. A shorter notice should contain the basic information to be provided when collecting personal data either directly from the data subject or from a third party. This should be accompanied by a more detailed notice. Special mention must be given to the guarantees that must be taken over data processing online or by Internet).
   2. Right of access (with a very interesting analysis concerning the right exercised by the minor or his/her representatives, taking into account that there may sometimes be a conflict of interest between them).
   3. Right to object (the cases when the right to object may possibly be subject to special consideration when the data subject is a minor).

In addition to the aforementioned important considerations, the document by WP 29 examines school data processing in detail, pinpointing highly interesting issues, for example, the use of biometric data or Closed Circuit Television (CCTV) systems, health data processing, school Web sites, and photography.

In its conclusions, the document emphasises the need to take the minor's interests into account. It points out that, in cases of conflicting interests, a solution can be sought by interpreting the directives in accordance with the general principles of the UN Convention on the Rights of the Child, namely, the best interest of the child.

The document underwent a public consultation process.

José-Luis Piñar Mañas, Ph.D. is an attorney at Piñar Mañas & Asociados Law Firm. He also is the former director of the Spanish Agency for Data Protection and former vice-chairman of the Article 29 Working Party and president of the Ibero-American Network of Data Protection. He can be reached at jlpinar@pmasociados.com.