backOn May 24, 2023, the National Data Protection Authority (ANPD) published Guideline CD/ANPD No. 1, which sets out the ANPD’s guidelines for the processing of children and teenagers’ personal data on any of the legal basis determined by Articles 7 and 11 of the General Data Protection Law (LGPD), provided that the best interests of the child and teenager are preserved.
According to a preliminary study published by the ANPD in September 2022, there were three possible interpretations of article 14 of the LGPD, which deals specifically with the processing of personal data of children and teenagers:
(i) Prevalence of parents’ consent: use parents’ consent, according to article 14, §1 of the LGPD, as the only legal hypothesis for the processing of children’s personal data;
(ii) Children’s and teenagers’ personal data considered as sensitive data: the exclusive use of the legal hypotheses set out in Article 11 to the processing of children’s and teenager’s personal data, as such data is considered sensitive data;
(iii) Possibility of applying the other legal basis: using the legal hypotheses provided for in articles 7 and 11 of the LGPD to process children’s and teenagers’ data, provided that the principle of best interests is observed.
Among the hypotheses set out in the preliminary study, the ANPD ruled that interpretation “iii” is the one that best fits the scenario. In this sense, the Guideline published in May 2023 establishes that the “processing of the personal data of children and teenagers may be carried out based on the legal hypotheses provided for in art. 7 or art. 11 of the LGPD, provided that their best interests are observed and prevail, to be assessed in the specific case, under the terms of article 14 of the Law.”
What is the best interests principle of children and teenagers?
The best interest principle of children and teenagers determines that the rights of children and teenagers shall prevail over other interests that may be at stake. It is a fundamental right that guarantees preserving the rights of children and teenagers.
This principle originates out of the provisions of the Federal Constitution, Article 227, which determines the need to prioritize the interests of children and teenagers is a duty of the family, society, and the state. Article 4 of the Statute of the Child and Teenager (ECA) determines the preservation of the rights of children and teenagers as a priority.
Likewise, the UK’s National Data Protection Authority (ICO – Information Commissioner’s Office) clarified that to assess whether the rights of children and teenagers are being preserved, it is necessary to observe whether data processing is following the guidelines laid down by the United Nations Convention on the Rights of the Child.
The ICO has therefore outlined several steps to identify/assess whether the best interests of children are being observed[1]:
Step 1: Assess the rights.
The first step is to assess the rights of the children who are data subjects to which data is to be processed, i.e. to assess what rights are at stake according to the system for protecting the rights of children and teenagers.
This means reviewing the Federal Constitution, the Statute of the Child and Teenager (ECA), the United Nations Convention on the Rights of the Child, other relevant regulations, international agreements, and policies relating to the processing of children’s and teenagers’ personal data.
Step 2: Identify the impacts on children’s and teenagers’ rights.
The second step is to assess in detail the impact of how, why, and when children’s and teenagers’ data is being processed. In addition, it is important to identify the role of parents and guardians in the processing of children’s and teenagers’ data, to understand how they are involved in this activity of processing their children’s data.
Mapping these variables is important to identify the impacts that your data processing service may have on children’s rights and best interests.
Step 3: Assess the impacts on children’s rights
After identifying the potential risks, the third step is identifying the likelihood of these impacts occurring and how they could impact the rights of children and teenagers.
Step 4: Create action plans
Once you have identified the likelihood and magnitude that your data processing service could affect the rights of children and teenagers, the fourth step is to create strategies/action plans capable of mitigating the risks identified in your assessment.
Guideline CD/ANPD No. 1 on processing children’s and teenagers’ data provided guidelines on how such processing can be based on the best interests of children and teenagers. Therefore, following the steps provided by ANPD might help to assess the best interests of children and teenagers and the lawfulness of data processing activities.
[1] “Best interests of the child self-assessment”. Available at: <https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/best-interests-of-the-child-self-assessment/>
share
