The importance of privacy by design and data protection impact assessments in strengthening protection of children's personal data under the GDPR

摘要

The General Data Protection Regulation that enters in to force on 25 May 2018 aims specifically to protect children and their personal data in the digital world. According to Recital 38, children 'may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal date'. Although indeed a laudable and relevant measure, the GDPR demonstrates many questions as to what said protection entails and how it can be effectively achieved. It is for instance highly questionable whether parental consent, as required by Article 8 GDPR, will actually be an adequate mechanism to protect children (Van der Hof, 201 7). Consent is completely ineffective in practice due to consent overload, information overload, complexity of data processing, and lack of actual choice (Schermer et al, 2014). What is more, depending on how strictly this provision is enforced and implemented, negative side effects may emerge that endanger, rather than protect or respect, a whole range of children's fundamental rights. A genuine risk, for instance, exists of children being excluded from online services, which might adversely impact their rights to development, information, freedom of expression, association, privacy, play, and education laid down in the 1989 United Nations Convention on the Rights of the Child(UNCRC).