When can children’s and young people’s data be published online?
There are always risks associated with the disclosure of the personal data of children and young people. For example, the information may be disseminated more widely than originally intended. This is particularly true for social media and search engines. Children’s personal data must be protected because children themselves may not understand the risks and consequences of processing their personal data or they may not know their rights. This article explains what organisers of children’s hobbies should take into account when publishing children’s information.
The need for publication must always be carefully assessed
The following imaginary examples are typical of hobby activities:
- A video of a child’s performance at a concert has been filmed and posted on social media.
- A child’s results are published on a team’s website.
- The sex, age, height, weight or other physiological data of a child is published on the event website of a sporting competition.
- Photos of a child are posted on social media in connection with an event.
- A child’s skills or appearance are assessed on social media by commenting on videos or pictures taken of him/her.
The photos and videos, name and other information associated with the child are personal data. There are always risks associated with the disclosure of the personal data of children and young people. Videos and photos can easily be turned into digital forgeries, which can be used, for example, to engage in bullying. The child can be judged and criticised if a video or picture of him/her is publicly shared for anyone to see. Information shared online can, in the worst case, expose a child or young person to sexual harassment and abuse. For example, on social media, strangers can collect information about a child and then approach him/her in a private message, asking to exchange photos and location information, for example.
The person publishing such information must assess on a case-by-case basis whether the disclosure of the child’s information is necessary and what the purpose of the disclosure is. The necessity should be assessed particularly carefully when publishing identifiable photographs and videos, audio files or precise physiological data.
Consent or legitimate interest as a basis for publication
Publication always requires a basis for it, which can be consent or a legitimate interest. Children’s photos or videos must not be posted online without the consent of the young person or his/her parent. Consent is also required if, for example, a child appears in an article or blog by an association. In the case of a young child, the consent of the child’s parents must be requested. In the case of young people, it is necessary to assess separately whether the young person understands the meaning of the consent given. Consent may also be withdrawn, in which case the data must be removed from the internet.
Under certain circumstances, personal data may be published without consent if publication is justified and necessary for legitimate interests. An association must determine the legitimate interests before publishing the information. The legitimate interests of the association may relate, for example, to increasing member engagement through the publication of information or to increasing the visibility of the association, for example by marketing and communicating about upcoming competitions or concerts. For example, publishing the names of children performing at a concert can be part of the communication for the event. Legitimate interests may also exist where the public and members of an association need to know information about a hobby for the purposes of participation in a competition or tournament and for monitoring and supervision purposes (e.g. gender, age and weight categories, results).
However, the association should note that legitimate interest as a basis for publication requires that the interests and rights of the child or young person have been particularly carefully assessed by means of a balance test.
The legitimate interest must be weighed up in relation to the rights of the child
A child and his/her parents have the right to object to the disclosure of information, even if there is a legitimate interest in disclosure. This is called the right to object, and the association must always inform you of this right before publishing your child’s personal data. However, the information may be published despite objections, if the association can demonstrate that there are legitimate and important reasons for disclosure that override the interests, rights and liberties of the child. This requires the publishing party to carefully assess the legitimate interests in relation to the rights and interests of the child, i.e. to have carried out a balance test.
The publishing party must always carefully consider whether it is necessary to publish the information. Information should not be put online without justification, even if consent has been given. This is particularly important when it comes to children. The controller is ultimately responsible for the lawfulness of the processing of personal data, i.e. that publication has been carried out in accordance with the law.
Author
Jasmina Heinonen
Jarmina Heinonen is a Senior Inspector at the Office of the Data Protection Ombudsman