The map shows the age at which children’s consent is sufficient to disclose their images and personal data. The map does not cover particularly sensitive circumstances, e.g. children involved in court proceedings or interviews carried out by press representatives, since these are subject to different rules.
National provisions will be replaced by new rules introduced with the General Data Protection Regulation (GDPR), which enters into force on 25 May 2018. However, the GDPR does leave some discretion to Member States. An outline of the current national rules therefore provides a helpful basis for comparing future national regulations enacted by Member States.
Several provisions of the EU Charter of Fundamental Rights apply, particularly those concerning private and family life (Article 7), protection of personal data (Article 8), freedom of expression and information (Article 11), and the rights of the child (Article 24). Article 16 of the Treaty on the Functioning of the European Union (TFEU) reiterates the right to protection of personal data, calling for rules relating to “the protection of individuals with regard to the processing of personal data”.
EU Member States’ international obligations stemming from the Convention on the Rights of the Child (CRC), the General Comments of the Committee on the Rights of the Child, and the European Convention on Human Rights have to be implemented, as well. Article 13 of the CRC, for instance, states that “the child shall have the right to freedom of expression” through any media. Access to the internet and social media is central to the child’s right to play, engage in recreational activities and participate in cultural life and the arts (protected by Article 31 of the CRC), as underlined by CRC General Comment No. 17. Particularly adolescents use the online environment to “explore their identity, learn, participate, express opinions, play, socialise, engage politically and discover employment opportunities” (CRC General Comment No. 20 on the implementation of the rights of the child during adolescence).
Based on Article 16 of the TFEU, the European Parliament and the Council adopted the General Data Protection Regulation (GDPR), which applies as of 25 May 2018. Article 8 outlines rules regarding children’s consent to the processing of their personal data (including the data’s disclosure) in relation to information society services offered directly to children. In this regard, the regulation specifies that, for children under 16, the holder of parental responsibility shall give or authorise the consent. However, Member States may provide for a lower age, as long as this is not below 13 years. National legal provisions still apply if the matter falls outside of the GDPR’s scope.
