National provisions will be replaced by new rules introduced with the General Data Protection Regulation (GDPR), which enters into force on 25 May 2018. However, the GDPR does leave some discretion to Member States. An outline of the current national rules therefore provides a helpful basis for comparing future national regulations enacted by Member States.
- Belgium, Bulgaria, the Czech Republic, Denmark, Germany, Hungary, Malta, the Netherlands, Slovakia, Spain and Sweden require only the child’s consent from a certain age onwards. To give consent, a child has to be 14 years old in Bulgaria and Spain; and 16 in Hungary and the Netherlands. In the other countries, maturity is required.
- In Cyprus, Croatia, Estonia, Finland, France, Greece, Ireland, Italy, Latvia, Portugal, Romania and Slovenia, only the parents have to provide their consent.
- Compared to the disclosure of personal data, when it comes to using the data, fewer EU Member States require a child’s consent, asking only for parental consent.
Ongoing developments regarding the General Data Protection Regulation (GDPR)
According to Article 8 of the GDPR, when processing personal data in relation to information society services offered directly to children under 16, consent shall be given or authorised by the holder of parental responsibility. Member States, however, may provide for a lower age, not below 13 years. In the framework of the regulation’s transposition, some Member States have already taken positions regarding this issue. These countries are listed below, with the information in parentheses indicating whether this is provided for by law or specified in a draft law.
- 13 years: the Czech Republic (draft law), Denmark (draft law), Ireland (draft law), Latvia (draft law), Poland (draft law), Spain (draft law), Sweden (draft law), the United Kingdom (law)
- 14 years: Austria (law), Italy (draft law)
- 16 years: Germany (law), Hungary (draft law), Lithuania (draft law), Luxembourg (draft law), the Netherlands (draft law), Slovakia (draft law)
Several provisions of the EU Charter of Fundamental Rights apply, particularly those concerning private and family life (Article 7), protection of personal data (Article 8), freedom of expression and information (Article 11), and the rights of the child (Article 24). Article 16 of the Treaty on the Functioning of the European Union (TFEU) reiterates the right to protection of personal data, calling for rules relating to “the protection of individuals with regard to the processing of personal data”.
EU Member States’ international obligations stemming from the Convention on the Rights of the Child (CRC), the General Comments of the Committee on the Rights of the Child, and the European Convention on Human Rights have to be implemented, as well. Article 13 of the CRC, for instance, states that “the child shall have the right to freedom of expression” through any media. Access to the internet and social media is central to the child’s right to play, engage in recreational activities and participate in cultural life and the arts (protected by Article 31 of the CRC), as underlined by CRC General Comment No. 17. Particularly adolescents use the online environment to “explore their identity, learn, participate, express opinions, play, socialise, engage politically and discover employment opportunities” (CRC General Comment No. 20 on the implementation of the rights of the child during adolescence).
General Data Protection Regulation
Based on Article 16 of the TFEU, the European Parliament and the Council adopted the General Data Protection Regulation (GDPR), which applies as of 25 May 2018. Article 8 outlines rules regarding children’s consent to the processing of their personal data (including the data’s use) in relation to information society services offered directly to children. In this regard, the regulation specifies that, for children under 16, the holder of parental responsibility shall give or authorise the consent. However, Member States may provide for a lower age, as long as this is not below 13 years. National legal provisions still apply if the matter falls outside of the GDPR’s scope.