Rights of children and vulnerable adults
Children have the same rights as adults over their personal data.
In addition to these standard rights, Recital 38 of the General Data Protection Regulation provides special protection of children's personal data, stating that "children require specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data".
This "specific protection" also applies to vulnerable adults.
A child may exercise their rights on their own behalf as long as they are competent to do so. In Scotland, a person aged 12 or over is presumed to be of sufficient age and maturity to be able to exercise their data protection rights, unless the contrary is shown. If you are seeking the consent of a parent or guardian acting on behalf of children or vulnerable adults, you should still make the data subject (child or vulnerable adult) aware that their data will be processed.
When processing personal data about children or vulnerable adults you must ensure that:
- The processing provides the specific protections required by Recital 38.
- Privacy information is written in clear and plain language that can be easily understood and is presented to data subjects in an accessible format. This could include creating an easy read Privacy Notice or one that incorporates images, video, or audio to communicate privacy information.
- Consent from a parent or guardian is obtained, unless the child (aged 12 or over) or vulnerable adult is deemed competent to provide their own consent.
- All of their rights under data protection legislation are met.