Privacy & Information Security Law Blog

On June 29, 2021, the UK Department for Digital, Culture, Media and Sport (“DCMS”) published guidance for businesses on child online safety, which includes guidance on data protection and privacy, age-appropriate content, positive user interactions, and protecting children from online sexual exploitation and abuse.

With respect to its guidance on data protection and privacy, DCMS states that children require particular protection when their personal data is used because they may be less aware of the risks involved and of their rights with respect to their data. DCMS recommends that organizations familiarize themselves with the key data protection law in the UK, the General Data Protection Regulation (“UK GDPR”), and with the Children’s Code (or Ages Appropriate Design Code) produced by the UK Information Commissioner’s Office (“ICO”). As we previously reported, the Children’s Code lists 15 standards that online services used by children must meet. DCMS also encourages taking part in the ICO Regulatory Sandbox, a service that supports organizations creating new products and services that use personal data in safely implementing these products and services.

In its guidance on positive user interactions, DCMS recommends that businesses consider implementing safety technology tools, such as age verification, to ensure that children are not able to access content aimed at adult audiences.

The ICO also is publishing additional guidance in relation to the Children’s Code  in the form of a series of blogs. Two such blogs have been published so far. The first, published on May 27, 2021, discusses the use of data protection impact assessments, which all organizations within the scope of the Children’s Code are required to complete. The second, published on July 28, 2021, discusses the best interests of the child, detrimental use of children’s data and data minimization. In particular, the blog highlights that organizations need to address children’s rights to be safe from commercial exploitation, to be protected from abuse, to have access to a wide range of information and media and to play. The ICO’s next “Spotlight” blog will cover transparency, parental controls and online tools.