Communications Law Volume 23 Number 1 2018 Pages 1-54

A User’s Guide to Data Protection Paul Lambert Data protection is a minefield of complex rules and regulations. It is an area of law that impacts on every organisation, large or small, that handles personal data. EDITORIAL A User’s Guide to Data Protection: Law and Policy, Third Edition sets out all the compliance issues that organisations need to be aware of in order to successfully IN BRIEF comply with UK data protection rules and regulations, along with a full assessment of the EU Data Protection Regulations and their impact on UK practice. ARTICLES The work is a first-port-of-call text providing clear guidance through the complex web of data protection issues and regulation, in relation to internal issues affecting Sharenting: balancing the conflicting rights of parents and children employees, agents, contractors, etc. It also addresses external issues concerning Claire Bessant customers, prospective customers and users across all areas of data interface. The third edition has been fully updated and includes coverage and analysis of: Are children more than ‘clickbait’ in the 21st century? • The General Data Protection Regulations (GDPR) to be implemented by May 2018 Baroness Beeban Kidron • Coverage of the new UK Data Protection Bill • Latest Information Commissioner Office investigations, reports and guidance, office Interpreting the child-related provisions of the GDPR cases, complaint decisions and penalties • Brexit negotiation issues and post-Brexit data protection implications Lisa Atkinson • Significant increased fines and penalties regime; and data protection competition law comparisons The importance of privacy by design and data protection impact • Right to be Forgotten updates and new cases assessments in strengthening protection of children’s personal data • The Conservative election proposals for the Right to be Forgotten • International developments and issues, Cloud, internet, revenge porn, online abuse under the GDPR • New security law and new data protection e-commerce and electronic Simone van der Hof and Eva Lievens communications data protection law ISBN. 9781526504999 Pub Date. 17-05-2018 Pages. 696 Price. £120.00 The transparency challenge: making children aware of their data protection rights and the risks online Anna Morgan

CASE NOTES & COMMENTS

RECENT DEVELOPMENTS

Volume 23 Volume Communications Law

Number 1 Number The Journal of Computer, Media and ISSN 1746-7616 Telecommunications Law 01

9 771746 761005 2018 www.bloomsburyprofessional.com

Comms law 23.1 cover.indd 1-3 01/02/2018 12:23 2

Guidelines for Contributors

Manuscripts should be sent to the Editor in Chief, Dr Paul Wragg Editor in Chief: ([email protected]) with a copy to the Managing Editor, Guidelines for Contributors Julian Harris ([email protected]). Dr Paul Wragg, Associate Professor, School of Law, University of Leeds Other correspondence should be sent to: A. Articles submitted should be original contributions 5. References to journals should appear as Richard Cox Editors: and should not be under consideration for publi- follows: (1987) 3 CL 193–97. Standard abbre- Production Editor Paul Chamberlain, Solicitor, Archerfield Partners LLP cation in any other journal. Copyright of material viations of titles are: Communications Law CL Bloomsbury Publishers Clive Davies, Senior Lawyer, Fujitsu Services published in the Journal rests with the Publishers, Professional Negligence PN Kemp House Brian Dowrick, Senior Lecturer in Law, Law School, University Chawley Park Bloomsbury Professional Limited. Contributors Trust Law International TLI of South Wales Cumnor Hill to the Journal will be asked ually be given (free Immigration, Asylum IANL Howard Johnson, Part-time Senior Teaching Fellow, Cardiff Oxford Law School of charge) to authors to publish their articles and Nationality Law OX2 9PH Dr Daithí Mac Síthigh, Professor of Law and Innovation, elsewhere, if they so request. Tel: 01865 596793 Queen’s University, Belfast Subsequent references to sources already used [email protected] Brian Pillans, Lecturer in Law, Glasgow Caledonian University B. Contributors are entitled to two copies of the issue should follow the ibid and supra system. N.B. Prospective contributors are advised to request a style sheet Dr Judith Townend, Lecturer in Media and Information Law, in which their article appears. before commencing their article. University of Sussex 6. Italicise or underline words to appear in italics. Subscription enquiries should be sent to News Editor: C. Articles must comply with the following specifica- [email protected] Campbell Deane, Bannatyne, Kirkwood, France & Co, tions as the Editor will not undertake the re-typing 7. Spelling should comply with British, not © Bloomsbury Professional Ltd 2018 Glasgow of submissions which do not comply with Journal American forms, eg -ise, not -ize, as in natio- Bloomsbury Professional, an imprint of Bloomsbury Publishing Plc Advisory Panel: style. nalise. Numbers one to twelve and per cent to be spelt out. Eduardo Bertoni, Director of the Centre for Studies on All rights reserved. No part of this publication may be 1. Manuscripts should be supplied in a format reproduced, stored in a retrieval system, or transmitted in any Freedom of Expression and Access for Information (CELE), form, or by any means, electronic, mechanical, photocopying, Palermo University School of Law, Argentina; former Special compatible with standard word-processing 8. Quotation marks: use single quotes recording, or otherwise, without the prior permission of Rapporteur for Freedom of Expression at the Organization of packages, preferably MS Word. Manuscripts throughout, except for a quote within a quote Bloomsbury Professional Ltd. While every effort has been American Studies should be emailed to linda.murray@blooms- – for this use double quotes. made to ensure that the information given in this Journal is Richard Caddell, Lecturer in Law, Cardiff Universtity; Senior bury.com or sent to the address given Research Associate and a Nippon Foundation Senior Nerens accurate, no responsibility (legal or otherwise) is accepted by on the inside front cover of this Journal. D. Book reviews: full publication information should the Publishers, the Editors, the members of the Editorial Board Fellow in International Fisheries Law, Utrecht University or the Contributors for any errors, omissions, or otherwise. The Michael Epstein, Professor of Law, Southwestern Law School, Please note that Bloomsbury Professional’s be given at the top of the review: title, author, opinions expressed in the articles which appear in the Journal are Los Angeles; Supervising Editor of the Journal of International Communications Law is a refereed journal. edition, publisher, date, ISBN/ISSN, number of those of the Contributors, and are not necessarily shared by the Media and Entertainment Law Contributors can obtain advice on any aspect pages, price, pb (paperback)/hb (hardback). Eg: Editors or the Publishers. Simon Gallant, Consultant, Gallant Maxwell of their contribution from the Editor at the Thomas Gibbons, School of Law, University of Manchester Annual subscription (including postage): £450 (UK), above email address. European Data Protection Law: David Goldberg, Senior Honorary Visiting Fellow, Institute £465 (overseas). of Computer Communications, Queen Mary, University of Corporate Regulation and Compliance Published four times a year by: London 2. Authors should keep at least one copy of their Christopher Kuner Bloomsbury Professional Ltd Wolfgang Kleinwächter, University of Aarhus, Special Adviser article. Oxford University Press Maxwelton House to the Chair of the UN Internet Governance Forum Second edition Jeremy Landau, Partner, Kirkpatrick & Lockhart Nicolson 41–43 Boltro Road 3. Book titles should be in italics or underlined; ISBN 0 19 928385 0 Haywards Heath Graham LLP articles/essays contained within should appear xxvii + 460 pp West Sussex RH16 1BJ David Rolph, Professor of Law, University of Sydney Tel: 01444 416119 Michael D Scott, Professor of Law, Southwestern Law in single quotes. Periodicals should be given £125.00 (hb) Fax: 01444 440426 School, Los Angeles; Director, International IT Law Summer their standard abbreviations and should not be Programme in London italicised eg LQR not Law Quarterly Review. Managing Editor: Julian Harris Gavin Sutter, Research Fellow, Centre for Commercial Law Designed and typeset by Marcus Duck Design Studies, Queen Mary, University of London Professor Ian Walden, Head of the Institute of Computer and 4. Law reports should appear using the standard Printed and bound in Great Britain by Hobbs the Printers Ltd, Communications Law, Centre for Commercial Law Studies, abbreviations of their titles and should not be Totton, Hampshire. Queen Mary, University of London and consultant to Baker & in italics or underlined. Full stops should not McKenzie be used in case names, or law report citations. Kyu Ho Youm, Jonathan Marshall First Amendment Chair Abbreviations should be preceded by year (in Peer Review Policy Professor, School of Journalism and Communication, University of Oregon square brackets where the year is an essential Where appropriate, academic submissions are sent to element, otherwise use round brackets) and independent referees for comment. The peer review process is based on initial editor screening and refereeing by two anony- volume number; page number(s) should follow mous referees. abbreviation: (1991) 88 LGR 737–750.

Communications Law Vol. 23, No. 1, 2018 Communications Law Vol. 23, No. 1, 2018

Comms law 23.1 cover.indd 4-6 01/02/2018 12:23

2 Editorial Editorial

Contents Editorial Contents Editorial

4 In Brief Children and digital rights 4 In Brief Children and digital rights

7 Sharenting: balancing the conflicting rights of The internet provides children with more freedom to 7 Sharenting: balancing the conflicting rights of The internet provides children with more freedom to parents and children communicate, learn, create, share, and engage with parents and children communicate, learn, create, share, and engage with Claire Bessant society than ever before. Research by Ofcom in 2016 Claire Bessant society than ever before. Research by Ofcom in 2016 found that 72 per cent of young teenagers in the UK found that 72 per cent of young teenagers in the UK 25 Are children more than ‘clickbait’ in the 21st have social media accounts. Twenty per cent of the 25 Are children more than ‘clickbait’ in the 21st have social media accounts. Twenty per cent of the century? same group have made their own digital music and 30 century? same group have made their own digital music and 30 Baroness Beeban Kidron per cent have used the internet for civic engagement Baroness Beeban Kidron per cent have used the internet for civic engagement by signing online petitions or by sharing and talking by signing online petitions or by sharing and talking 31 Interpreting the child-related provisions of the about the news. 31 Interpreting the child-related provisions of the about the news. GDPR GDPR Lisa Atkinson Interacting within this connected digital world, Lisa Atkinson Interacting within this connected digital world, however, also presents a number of challenges to however, also presents a number of challenges to 33 The importance of privacy by design and data ensuring the adequate protection of a child’s rights to 33 The importance of privacy by design and data ensuring the adequate protection of a child’s rights to protection impact assessments in strengthening privacy, freedom of expression, and safety, both online protection impact assessments in strengthening privacy, freedom of expression, and safety, both online protection of children’s personal data under and offline. These risks range from children being protection of children’s personal data under and offline. These risks range from children being the GDPR unable to identify advertisements on search engines to the GDPR unable to identify advertisements on search engines to Simone van der Hof and Eva Lievens being subjects of bullying or grooming or other types Simone van der Hof and Eva Lievens being subjects of bullying or grooming or other types of abuse in online chat groups. Children may also of abuse in online chat groups. Children may also 44 The transparency challenge: making children be targeted via social media platforms with methods 44 The transparency challenge: making children be targeted via social media platforms with methods aware of their data protection rights and the (such as fake online identities or manipulated photos aware of their data protection rights and the (such as fake online identities or manipulated photos risks online and images) specially designed to harm them or risks online and images) specially designed to harm them or Anna Morgan exploit their particular vulnerabilities and naivety. Anna Morgan exploit their particular vulnerabilities and naivety.

48 Case Notes & Comments These issues were the subject of ‘Children and digital 48 Case Notes & Comments These issues were the subject of ‘Children and digital rights: regulating freedoms and safeguards’, the 2017 rights: regulating freedoms and safeguards’, the 2017 50 Recent Developments Annual Conference of the Information Law & Policy 50 Recent Developments Annual Conference of the Information Law & Policy Centre (ILPC) based at the Institute of Advanced Legal Centre (ILPC) based at the Institute of Advanced Legal Studies, University of London. The ILPC produces, Studies, University of London. The ILPC produces, promotes, and facilitates research about the law and promotes, and facilitates research about the law and policy of information and data, and the ways in which policy of information and data, and the ways in which law both restricts and enables the sharing and disse- law both restricts and enables the sharing and dissemination of different types of information. The confe- mination of different types of information. The conference – held on 17 November 2017 and one of a rence – held on 17 November 2017 and one of a series of events celebrating the 70th anniversary of the series of events celebrating the 70th anniversary of the founding of the Institute of Advanced Legal Studies – founding of the Institute of Advanced Legal Studies – was sponsored by Communications Law, and some of was sponsored by Communications Law, and some of the papers presented, discussed and debated during the papers presented, discussed and debated during the day feature in this special issue of the journal. the day feature in this special issue of the journal.

Leading policymakers and regulators from government Leading policymakers and regulators from government (including senior representatives from the Department (including senior representatives from the Department of Digital (DCMS), the Information Commissioner’s of Digital (DCMS), the Information Commissioner’s Ofﬁce and the Deputy Data Protection Commissioner Ofﬁce and the Deputy Data Protection Commissioner of Ireland), industry (Simon Milner, Facebook’s of Ireland), industry (Simon Milner, Facebook’s Policy Director for the UK, Africa, and Middle East), Policy Director for the UK, Africa, and Middle East),

Communications Law Vol. 23, No. 1, 2018 1 Communications Law Vol. 23, No. 1, 2018 1 Editorial Editorial

practitioners, and academic experts examined the Her powerful conclusion is that government needs practitioners, and academic experts examined the Her powerful conclusion is that government needs opportunities and challenges posed by current and to take a greater interest in the developmental opportunities and challenges posed by current and to take a greater interest in the developmental future legal frameworks and the policies being used needs of children on the internet – and so should future legal frameworks and the policies being used needs of children on the internet – and so should and developed to safeguard these freedoms and Silicon Valley by re-engineering its metadata captu- and developed to safeguard these freedoms and Silicon Valley by re-engineering its metadata captu- rights. ring policy to reflect those needs. She explains the rights. ring policy to reflect those needs. She explains the amendments to the GDPR that she (and others) amendments to the GDPR that she (and others) These legal systems included the UN Convention on initiated, which would put children’s development at These legal systems included the UN Convention on initiated, which would put children’s development at the Rights of the Child and the related provisions of the forefront of data protection rules, thus enabling the Rights of the Child and the related provisions of the forefront of data protection rules, thus enabling the UK Digital Charter, and the UK Data Protection the Information Commissioner to play an active role the UK Digital Charter, and the UK Data Protection the Information Commissioner to play an active role Bill, which will implement the major reforms of the in this important area. Bill, which will implement the major reforms of the in this important area. EU General Data Protection Regulation (2016/678) EU General Data Protection Regulation (2016/678) which soon enter into force on 25 May 2018. Continuing the theme of GDPR and its implica- which soon enter into force on 25 May 2018. Continuing the theme of GDPR and its implica- Concerns expressed at the conference by delegates tion for children, Lisa Atkinson, (Group Manager Concerns expressed at the conference by delegates tion for children, Lisa Atkinson, (Group Manager included the effectiveness in practice and lack of in the Policy and Engagement Department of the included the effectiveness in practice and lack of in the Policy and Engagement Department of the evidence-based policy for the controversial age of Information Commissioner’s Office), offers insights evidence-based policy for the controversial age of Information Commissioner’s Office), offers insights consent for children and their use of online informa- into this process. She is leading the ICO’s work on consent for children and their use of online informa- into this process. She is leading the ICO’s work on tion services provided for under the GDPR and the interpreting the child-related provisions of the GDPR. tion services provided for under the GDPR and the interpreting the child-related provisions of the GDPR. impact of the new transparency and accountability Her article delivers a positive message: that the GDPR impact of the new transparency and accountability Her article delivers a positive message: that the GDPR principles that must be implemented by data control- ‘is an opportunity to reflect and recalibrate. This can principles that must be implemented by data control- ‘is an opportunity to reflect and recalibrate. This can lers when their data processing involves the personal only be a good thing, and we await further develop- lers when their data processing involves the personal only be a good thing, and we await further develop- data of children. ments and debate with interest’. She explains the new data of children. ments and debate with interest’. She explains the new measures arising from the GDPR, in practical terms measures arising from the GDPR, in practical terms In ‘Sharenting: balancing conflicting rights of parents and with great clarity. In ‘Sharenting: balancing conflicting rights of parents and with great clarity. and children’, Claire Bessant, Associate Professor at and children’, Claire Bessant, Associate Professor at Northumbria University, asks the important question Professors Simone van der Hof and Eva Lievens, Northumbria University, asks the important question Professors Simone van der Hof and Eva Lievens, of whether (and how) children might obtain a remedy from Leiden University and Ghent University respec- of whether (and how) children might obtain a remedy from Leiden University and Ghent University respec- when their parents share private photographs of them tively, in their joint paper, ‘Protection of children when their parents share private photographs of them tively, in their joint paper, ‘Protection of children without their consent. As she recognises, ‘sharenting’ under the GDPR: how to achieve meaningful control without their consent. As she recognises, ‘sharenting’ under the GDPR: how to achieve meaningful control – the act of parents sharing information about their over personal data by parents and children’ provide – the act of parents sharing information about their over personal data by parents and children’ provide children – has become ubiquitous in the digital age. a thoughtful exploration of the underlying doctrine children – has become ubiquitous in the digital age. a thoughtful exploration of the underlying doctrine So much so, that there is little public consciousness and philosophical implications of the new regula- So much so, that there is little public consciousness and philosophical implications of the new regula- of the privacy implications that (especially) cavalier tions. Their starting point recognises the protec- of the privacy implications that (especially) cavalier tions. Their starting point recognises the protec- attitudes towards social media privacy settings tion of children provisions in the GDPR, ‘although attitudes towards social media privacy settings tion of children provisions in the GDPR, ‘although generate. In her view, the misuse of private informa- indeed…laudable, …raises many questions as to what generate. In her view, the misuse of private informa- indeed…laudable, …raises many questions as to what tion tort may provide for a meaningful remedy, but said protection entails and how it can be effectively tion tort may provide for a meaningful remedy, but said protection entails and how it can be effectively only if the court is prepared to place the interests of achieved.’ For them, for example, it is ‘highly questio- only if the court is prepared to place the interests of achieved.’ For them, for example, it is ‘highly questio- the children above parental decision-making. nable’ whether parental consent will be a meaningful the children above parental decision-making. nable’ whether parental consent will be a meaningful mechanism to protect children given the realities of mechanism to protect children given the realities of Baroness Kidron OBE, one of the country’s leading ‘consent overload, information overload, complexity Baroness Kidron OBE, one of the country’s leading ‘consent overload, information overload, complexity children’s online rights campaigners, develops a of data processing, and lack of actual choice’. Further, children’s online rights campaigners, develops a of data processing, and lack of actual choice’. Further, different theme in the ILPC’s 2017 Annual Lecture, it may jeopardise child development through exclu- different theme in the ILPC’s 2017 Annual Lecture, it may jeopardise child development through exclu- ‘Are children more than ‘clickbait’ in the 21st century?’ sion from online services. The paper challenges this ‘Are children more than ‘clickbait’ in the 21st century?’ sion from online services. The paper challenges this She asks how children interact with digital technology, ‘illusion of autonomy and control’ by exploring alter- She asks how children interact with digital technology, ‘illusion of autonomy and control’ by exploring alter- and argues strongly that there is insufficient recogni- native ‘tools’ to protect and empower children. Their and argues strongly that there is insufficient recogni- native ‘tools’ to protect and empower children. Their tion of a child’s digital needs. As she puts it, a new conclusions are of both academic and practical value. tion of a child’s digital needs. As she puts it, a new conclusions are of both academic and practical value. deal is required, on terms that deal is required, on terms that We finish with a paper from Anna Morgan, solicitor We finish with a paper from Anna Morgan, solicitor must include their right to change their digital and Deputy Commissioner (Head of Legal) for the must include their right to change their digital and Deputy Commissioner (Head of Legal) for the footprint and identity; to be safe and supported in Data Protection Commissioner for Ireland. Drawing footprint and identity; to be safe and supported in Data Protection Commissioner for Ireland. Drawing online settings; to understand who, how and what upon her experience as lead rapporteur for the online settings; to understand who, how and what upon her experience as lead rapporteur for the their data is being used for; to be informed and Article 29 Working Party Guidelines on Transparency their data is being used for; to be informed and Article 29 Working Party Guidelines on Transparency creative participant digital citizens; and above all, under the GDPR, she discusses the compliance issues creative participant digital citizens; and above all, under the GDPR, she discusses the compliance issues to have ‘agency’ – meaningful choice in an environ- surrounding the transparency provisions in a child to have ‘agency’ – meaningful choice in an environ- surrounding the transparency provisions in a child ment that is responsive to, and respectful of, their full context. As she notes, this will be challenging for data ment that is responsive to, and respectful of, their full context. As she notes, this will be challenging for data complement of rights and needs as minors. controllers: complement of rights and needs as minors. controllers:

2 Communications Law Vol. 23, No. 1, 2018 2 Communications Law Vol. 23, No. 1, 2018 Editorial Editorial

No matter how accessibly or appealingly privacy infor- ‘embraced… by data protection authorities, policy No matter how accessibly or appealingly privacy infor- ‘embraced… by data protection authorities, policy mation is presented on a website or an app used by makers, educators, and parents who all have vital mation is presented on a website or an app used by makers, educators, and parents who all have vital children, if child users do not appreciate the signiﬁ- roles to play when it comes to educating children and children, if child users do not appreciate the signiﬁ- roles to play when it comes to educating children and cance of what that information is telling them, then young people about their rights and risks online’. cance of what that information is telling them, then young people about their rights and risks online’. the risk is that they will swipe right past it without the risk is that they will swipe right past it without taking any notice of it. Dr Nóra Ni Loideain taking any notice of it. Dr Nóra Ni Loideain Director, Information Law & Policy Centre, Institute Director, Information Law & Policy Centre, Institute As she recognises, the ‘biggest transparency challenge’ of Advanced Legal Studies, University of London As she recognises, the ‘biggest transparency challenge’ of Advanced Legal Studies, University of London will be to motivate children to ‘want to unders- will be to motivate children to ‘want to understand how and why their personal data is used and Dr Paul Wragg tand how and why their personal data is used and Dr Paul Wragg processed’. This, she argues, is a cultural issue and Associate Professor of Law, University of Leeds processed’. This, she argues, is a cultural issue and Associate Professor of Law, University of Leeds not simply a technical one: the challenge must be not simply a technical one: the challenge must be

Communications Law Vol. 23, No. 1, 2018 3 Communications Law Vol. 23, No. 1, 2018 3 In Brief In Brief

In Brief In Brief

Government to give the needs of all UK audiences in setting the require- Government to give the needs of all UK audiences in setting the require- commercial radio more ments on a UK basis; commercial radio more ments on a UK basis; freedom on content freedom on content Q while the government still believes that the local- Q while the government still believes that the local- ness requirements for non-news and local infor- ness requirements for non-news and local infor- Commercial radio stations will have greater freedom mation content can be removed, there is a need Commercial radio stations will have greater freedom mation content can be removed, there is a need to increase their choice of music genres and respond for greater clarity in legislation deﬁning what is to increase their choice of music genres and respond for greater clarity in legislation deﬁning what is to the needs of listeners under new rules announced meant by locally-sourced news, and Ofcom should to the needs of listeners under new rules announced meant by locally-sourced news, and Ofcom should by Digital Minister Matt Hancock. produce guidance in this area. by Digital Minister Matt Hancock. produce guidance in this area.

Under the current regulations, analogue radio stations The government intends to seek powers to enabtle Under the current regulations, analogue radio stations The government intends to seek powers to enabtle have to play a particular genre of music as part of their Ofcom to license overseas services on UK DAB. This have to play a particular genre of music as part of their Ofcom to license overseas services on UK DAB. This licence agreement with Ofcom. This stipulation is being means that digital radio listeners will now be able to licence agreement with Ofcom. This stipulation is being means that digital radio listeners will now be able to removed, and there will also be no requirement for listen to stations based in the Republic of Ireland, and removed, and there will also be no requirement for listen to stations based in the Republic of Ireland, and Ofcom to approve changes to programme formats. the government will gradually extend this to stations Ofcom to approve changes to programme formats. the government will gradually extend this to stations However, with recent research showing that radio is the licensed in the European Union. However, with recent research showing that radio is the licensed in the European Union. most trusted medium for news, strong requirements will most trusted medium for news, strong requirements will remain on commercial radio stations to provide national The proposals will require major changes to the remain on commercial radio stations to provide national The proposals will require major changes to the and local news as well as travel information and weather. Broadcasting Act 1990, the Broadcasting Act 1996, and local news as well as travel information and weather. Broadcasting Act 1990, the Broadcasting Act 1996, and the Communications Act 2013. DCMS will and the Communications Act 2013. DCMS will A consultation was launched in February 2017 on progress the arrangements and begin detailed work to A consultation was launched in February 2017 on progress the arrangements and begin detailed work to commercial radio deregulation, and the Department develop the new legislative structure prior to analogue commercial radio deregulation, and the Department develop the new legislative structure prior to analogue for Digital, Culture, Media & Sport (DCMS) published licences coming up for renewal in 2022. for Digital, Culture, Media & Sport (DCMS) published licences coming up for renewal in 2022. the government response on 18 December 2017. the government response on 18 December 2017. Some changes to the original proposals have been Some changes to the original proposals have been made in the light of comments received: High speed broadband to made in the light of comments received: High speed broadband to become a legal right become a legal right Q the government still intends to seek powers to Q the government still intends to seek powers to enable Ofcom to license overseas services, but a The government has conﬁrmed that universal high enable Ofcom to license overseas services, but a The government has conﬁrmed that universal high more gradual approach is to be adopted starting speed broadband will be delivered by a regulatory more gradual approach is to be adopted starting speed broadband will be delivered by a regulatory with Republic of Ireland services; Universal Service Obligation (USO), giving everyone in with Republic of Ireland services; Universal Service Obligation (USO), giving everyone in the UK access to speeds of at least 10 Mbps by 2020. the UK access to speeds of at least 10 Mbps by 2020. Q there was no consensus on whether obligations to Q there was no consensus on whether obligations to provide news or core information in the event of After careful consideration the government has provide news or core information in the event of After careful consideration the government has a future digital radio switchover should fall to the decided that regulation is the best way of making a future digital radio switchover should fall to the decided that regulation is the best way of making existing stations or local multiplex operators (or sure everyone in the UK can get a decent broadband existing stations or local multiplex operators (or sure everyone in the UK can get a decent broadband some combination of the two), and further discus- connection as soon as possible. Ofcom has said that a some combination of the two), and further discus- connection as soon as possible. Ofcom has said that a sions will take place with the radio industry; speed of least 10 Mbps is needed to meet the require- sions will take place with the radio industry; speed of least 10 Mbps is needed to meet the requirements of an average family. ments of an average family. Q a clear view was expressed that there was no need Q a clear view was expressed that there was no need for Ofcom to have the power to set different news The design for a legal right to high speed broadband for Ofcom to have the power to set different news The design for a legal right to high speed broadband (national or local) or other local requirements in will be set out in secondary legislation in the early part (national or local) or other local requirements in will be set out in secondary legislation in the early part the nations, and the government has decided that of this year. Ofcom’s implementation is expected to the nations, and the government has decided that of this year. Ofcom’s implementation is expected to a better approach is for Ofcom to have regards to take two years from when secondary legislation is laid. a better approach is for Ofcom to have regards to take two years from when secondary legislation is laid.

4 Communications Law Vol. 23, No. 1, 2018 4 Communications Law Vol. 23, No. 1, 2018 In Brief In Brief

In summer 2017 BT made a proposal to deliver these rights around the online processing of a child’s In summer 2017 BT made a proposal to deliver these rights around the online processing of a child’s universal broadband through a voluntary agreement, personal data in the Bill. universal broadband through a voluntary agreement, personal data in the Bill. but the government believes that only a regulatory but the government believes that only a regulatory USO offers sufficient certainty and the legal enforcea- The new code would have the same enforceability as USO offers sufficient certainty and the legal enforcea- The new code would have the same enforceability as bility that is required to ensure high speed broadband the government’s codes on direct marketing and data bility that is required to ensure high speed broadband the government’s codes on direct marketing and data access for the whole of the UK by 2020. sharing. It also has a clear link to enforcement provi- access for the whole of the UK by 2020. sharing. It also has a clear link to enforcement provisions already set out in the Bill. sions already set out in the Bill. The government considers that its regulatory approach The government considers that its regulatory approach also brings a number of other advantages for the It is expected that non-compliance with the code also brings a number of other advantages for the It is expected that non-compliance with the code consumer: would play a relevant factor in any ICO decision to consumer: would play a relevant factor in any ICO decision to bring forward enforcement action against websites bring forward enforcement action against websites Q the minimum speed of connection can be increased that do not comply with the Data Protection Bill – Q the minimum speed of connection can be increased that do not comply with the Data Protection Bill – over time as consumers’ connectivity requirements including in determining the level of fines of up to over time as consumers’ connectivity requirements including in determining the level of fines of up to evolve; £18 million or 4 per cent of global turnover. evolve; £18 million or 4 per cent of global turnover.

Q it provides for greater enforcement to help ensure Q it provides for greater enforcement to help ensure households and businesses do get connected; Changes to Electronic households and businesses do get connected; Changes to Electronic Communications Code come Communications Code come Q the scheme will maximise the provision of ﬁxed line into effect Q the scheme will maximise the provision of ﬁxed line into effect connections in the hardest to reach areas; connections in the hardest to reach areas;

Q the scheme places a legal requirement for high Reforms to the Electronic Communications Code Q the scheme places a legal requirement for high Reforms to the Electronic Communications Code speed broadband to be provided to anyone reques- (EEC) reflecting changes made by the Digital Economy speed broadband to be provided to anyone reques- (EEC) reflecting changes made by the Digital Economy ting it, subject to a cost threshold (in the same way Act 2017 have come into force. ting it, subject to a cost threshold (in the same way Act 2017 have come into force. the universal service right to a landline telephone the universal service right to a landline telephone works). The reformed Code, which took effect on 28 works). The reformed Code, which took effect on 28 December 2017, will reduce the costs of housing December 2017, will reduce the costs of housing phone masts and other communications infrastruc- phone masts and other communications infrastruc- Children to be given extra ture on private land. This opens the way for faster and Children to be given extra ture on private land. This opens the way for faster and protection online more reliable broadband and mobile services, particu- protection online more reliable broadband and mobile services, particularly in rural areas. larly in rural areas. A new statutory power to ensure greater protec- A new statutory power to ensure greater protection for children online has been proposed by the The government says changes to the EEC will: tion for children online has been proposed by the The government says changes to the EEC will: government. government. Q bring down the rents telecoms operators pay to Q bring down the rents telecoms operators pay to The new power has been added as an amend- landowners to install equipment to be more in line The new power has been added as an amend- landowners to install equipment to be more in line ment to the Data Protection Bill, and has cross party with utilities providers, such as gas and water; ment to the Data Protection Bill, and has cross party with utilities providers, such as gas and water; support. The government’s proposals will require the support. The government’s proposals will require the Information Commissioner’s Office (ICO) to produce Q make it easier for operators to upgrade and share Information Commissioner’s Office (ICO) to produce Q make it easier for operators to upgrade and share a statutory code of practice on age-appropriate their equipment with other operators to help a statutory code of practice on age-appropriate their equipment with other operators to help website design. increase coverage; website design. increase coverage;

Standards required of websites and app makers on Q make it easier for telecoms operators and Standards required of websites and app makers on Q make it easier for telecoms operators and privacy for children under the age of 16 will be set landowners to resolve legal disputes; and privacy for children under the age of 16 will be set landowners to resolve legal disputes; and by the new code. It will also ensure that websites and by the new code. It will also ensure that websites and apps must be designed to make clear what personal Q help to drive investment and stimulate the conti- apps must be designed to make clear what personal Q help to drive investment and stimulate the conti- data of children is being collected, how it is being nued growth, rollout and maintenance of commu- data of children is being collected, how it is being nued growth, rollout and maintenance of commu- used, and how both children and parents can stay in nication technology infrastructure, an increasingly used, and how both children and parents can stay in nication technology infrastructure, an increasingly control of this data. signiﬁcant area of the UK’s economy. control of this data. signiﬁcant area of the UK’s economy.

The amendment has the support of Baroness Kidron Obligations have been placed on Ofcom to publish: The amendment has the support of Baroness Kidron Obligations have been placed on Ofcom to publish: and Baroness Harding, who have campaigned for and Baroness Harding, who have campaigned for many years to protect the rights and safety of children Q a Code of Practice to accompany the changes to the many years to protect the rights and safety of children Q a Code of Practice to accompany the changes to the on the internet. The government has worked closely Electronic Communications Code; on the internet. The government has worked closely Electronic Communications Code; with campaigners on the new amendment, to secure with campaigners on the new amendment, to secure

Communications Law Vol. 23, No. 1, 2018 5 Communications Law Vol. 23, No. 1, 2018 5 In Brief In Brief

Q a number of template notices which must or may failing to take all reasonable steps to ensure accuracy Q a number of template notices which must or may failing to take all reasonable steps to ensure accuracy (depending on the circumstances in question) be prior to publication, The Canary breached the (depending on the circumstances in question) be prior to publication, The Canary breached the used by Code operators and landowners/occupiers; IMPRESS Standards Code. used by Code operators and landowners/occupiers; IMPRESS Standards Code. and and An updated version of the article released at 16:50 on An updated version of the article released at 16:50 on Q standard terms which may (but need not) be used 27 September 2017 also breached the Code because Q standard terms which may (but need not) be used 27 September 2017 also breached the Code because by Code operators and landowners or occupiers it did not correct this significant inaccuracy with due by Code operators and landowners or occupiers it did not correct this significant inaccuracy with due when negotiating agreements to confer Code rights. prominence. The Canary was ordered by IMPRESS to when negotiating agreements to confer Code rights. prominence. The Canary was ordered by IMPRESS to publish a home page correction in the same-sized font publish a home page correction in the same-sized font as the original article and to release the correction on as the original article and to release the correction on Revisions made to Editors’ the same social media channels as the original article. Revisions made to Editors’ the same social media channels as the original article. Code of Practice Code of Practice IMPRESS was contacted by 52 complainants who IMPRESS was contacted by 52 complainants who The Editors’ Code of Practice, under which the vast raised concerns about the article in question, and The Editors’ Code of Practice, under which the vast raised concerns about the article in question, and majority of Britain’s newspaper, magazine and news one complainant chose to escalate their complaint to majority of Britain’s newspaper, magazine and news one complainant chose to escalate their complaint to website journalists work, has been revised after a IMPRESS following The Canary’s initial response. The website journalists work, has been revised after a IMPRESS following The Canary’s initial response. The public consultation. Canary cooperated fully with IMPRESS’s investigation, public consultation. Canary cooperated fully with IMPRESS’s investigation, which was mounted in response to the complaint and which was mounted in response to the complaint and The revised Code, which came into effect on 1 on issues identified by IMPRESS on its own initiative. The revised Code, which came into effect on 1 on issues identified by IMPRESS on its own initiative. January 2018, is applied by the Independent Press January 2018, is applied by the Independent Press Standards Organisation (IPSO). One of the changes Standards Organisation (IPSO). One of the changes offers increased protection to children accused of BBFC proposed as age- offers increased protection to children accused of BBFC proposed as age- crime (cl 9), and in a move that goes further than the verification regulator for crime (cl 9), and in a move that goes further than the verification regulator for law requires, the Code now states that editors should online pornography law requires, the Code now states that editors should online pornography generally avoid naming children after arrest for a generally avoid naming children after arrest for a criminal offence but before they appear in court. criminal offence but before they appear in court. The British Board of Film Classification (BBFC) has been The British Board of Film Classification (BBFC) has been An amendment has also been made to clause 2 proposed by the government as the regulator for the An amendment has also been made to clause 2 proposed by the government as the regulator for the (Privacy), to clarify how the public domain is taken age of verification of online pornography in the UK. (Privacy), to clarify how the public domain is taken age of verification of online pornography in the UK. into account when complaints are considered, and into account when complaints are considered, and to clause 11 (Victims of sexual assault), to align it Age verification will mean anyone who makes porno- to clause 11 (Victims of sexual assault), to align it Age verification will mean anyone who makes porno- more closely with the law. In a further development, graphy available online on a commercial basis must more closely with the law. In a further development, graphy available online on a commercial basis must the Editors’ Code of Practice Committee has recom- ensure under 18s in the UK cannot access it. The the Editors’ Code of Practice Committee has recom- ensure under 18s in the UK cannot access it. The mended that IPSO should consider how member government sees the BBFC as having unparalleled mended that IPSO should consider how member government sees the BBFC as having unparalleled publishers report on commercial transparency. expertise in classifying content, and it can demons- publishers report on commercial transparency. expertise in classifying content, and it can demonstrate a proven track record of interpreting and imple- trate a proven track record of interpreting and implementing legislation as the statutory authority for age menting legislation as the statutory authority for age The Canary found to have rating videos under the Video Recordings Act. The Canary found to have rating videos under the Video Recordings Act. breached IMPRESS standards breached IMPRESS standards These factors, along with BBFC’s work with industry These factors, along with BBFC’s work with industry An IMPRESS Regulatory Committee has found The on the film classification system and more recently An IMPRESS Regulatory Committee has found The on the film classification system and more recently Canary to be in breach of its Standards Code over an classifying material for mobile network operators, Canary to be in breach of its Standards Code over an classifying material for mobile network operators, article criticising the BBC journalist Laura Kuenssberg makes them the government’s preferred choice. article criticising the BBC journalist Laura Kuenssberg makes them the government’s preferred choice. for speaking at the Conservative Party conference. The government’s proposal must be approved by for speaking at the Conservative Party conference. The government’s proposal must be approved by Parliament before the BBFC is officially designated as Parliament before the BBFC is officially designated as The Canary is a political blog supportive of Labour the age-verification regulator. The Canary is a political blog supportive of Labour the age-verification regulator. leader Jeremy Corbyn which describes itself as ‘an leader Jeremy Corbyn which describes itself as ‘an independent, progressive news website.’ In the The regulator will notify non-compliant pornogra- independent, progressive news website.’ In the The regulator will notify non-compliant pornogra- headline of the article first published at noon on 27 phic providers, and be able to direct internet service headline of the article first published at noon on 27 phic providers, and be able to direct internet service September 2017, The Canary stated: ‘We need to talk providers to prevent customers accessing these sites. September 2017, The Canary stated: ‘We need to talk providers to prevent customers accessing these sites. about Laura Kuenssberg. She’s listed as a speaker at It will also notify payment-services providers and about Laura Kuenssberg. She’s listed as a speaker at It will also notify payment-services providers and the Tory Party conference’. other ancillary service providers of these sites, with the Tory Party conference’. other ancillary service providers of these sites, with the intention that they can withdraw their services. the intention that they can withdraw their services. In fact, as the remainder of the article made clear, Guidance on how the regulator should fulfil its duties In fact, as the remainder of the article made clear, Guidance on how the regulator should fulfil its duties Laura Kuenssberg had only been invited to speak at will be published by the government. Laura Kuenssberg had only been invited to speak at will be published by the government. a fringe event. In misrepresenting those facts and in a fringe event. In misrepresenting those facts and in

6 Communications Law Vol. 23, No. 1, 2018 6 Communications Law Vol. 23, No. 1, 2018 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

Sharenting: balancing the Sharenting: balancing the conﬂicting rights of parents conﬂicting rights of parents and children and children

Claire Bessant Claire Bessant

Introduction child successfully sue their parents for sharenting? In Introduction child successfully sue their parents for sharenting? In attempting to answer that question this article analyses attempting to answer that question this article analyses Many parents share information about their children the remedies in English law that a child might use Many parents share information about their children the remedies in English law that a child might use online. It is reported that in the United States 92 per to prevent sharenting and to secure the removal of online. It is reported that in the United States 92 per to prevent sharenting and to secure the removal of cent of children have an online presence due to their sharented information. cent of children have an online presence due to their sharented information. parents’ disclosures by the age of two years old.1 parents’ disclosures by the age of two years old.1 Although in the United Kingdom far fewer parents The sharenting phenomenon Although in the United Kingdom far fewer parents The sharenting phenomenon admit to sharing their children’s information online,2 admit to sharing their children’s information online,2 many parents will post hundreds of photographs of Many parents use online platforms, including many parents will post hundreds of photographs of Many parents use online platforms, including their children before they reach their fifth birthday.3 Facebook, Flickr, Instagram, Snapchat, Pinterest, their children before they reach their fifth birthday.3 Facebook, Flickr, Instagram, Snapchat, Pinterest, So many parents now share information about their Twitter, and Mumsnet to share anecdotes, quotes and So many parents now share information about their Twitter, and Mumsnet to share anecdotes, quotes and children online that a new term, ‘sharenting,’ has personal information about their children, including children online that a new term, ‘sharenting,’ has personal information about their children, including emerged to describe the phenomenon. ‘Sharenting’ information about behaviour, development, appear- emerged to describe the phenomenon. ‘Sharenting’ information about behaviour, development, appear- here means the ‘habitual use of social media to share ance, and health. 12 Photographs are often shared.13 here means the ‘habitual use of social media to share ance, and health. 12 Photographs are often shared.13 news, images, etc of one’s children’.4 Indeed, sharenting frequently begins before birth, news, images, etc of one’s children’.4 Indeed, sharenting frequently begins before birth, with the uploading of foetal ultrasound photographs.14 with the uploading of foetal ultrasound photographs.14 Parents are often considered the ‘guardians,’5 or Significant numbers of parents blog.15 Whilst some Parents are often considered the ‘guardians,’5 or Significant numbers of parents blog.15 Whilst some ‘gatekeepers’6 of their children’s personal information. bloggers use pseudonyms or avoid posting their ‘gatekeepers’6 of their children’s personal information. bloggers use pseudonyms or avoid posting their Their role in providing consent to use their children’s children’s faces, others openly disclose their children’s Their role in providing consent to use their children’s children’s faces, others openly disclose their children’s information is recognised in European Union legisla- names, images and locations.16 Some parents use information is recognised in European Union legisla- names, images and locations.16 Some parents use tion7 and the jurisprudence of the European Court websites such as YouTube to vlog.17 Depending upon tion7 and the jurisprudence of the European Court websites such as YouTube to vlog.17 Depending upon of Human Rights (ECtHR).8 The English judiciary the privacy settings a parent uses and the extent of of Human Rights (ECtHR).8 The English judiciary the privacy settings a parent uses and the extent of also seemingly acknowledge that parents are the their social media following, children’s information also seemingly acknowledge that parents are the their social media following, children’s information best people to decide whether a child’s informa- may be shared with family, with parents’ friends, best people to decide whether a child’s informa- may be shared with family, with parents’ friends, tion is shared.9 In the sharenting context, however, acquaintances and professional networks, or the world tion is shared.9 In the sharenting context, however, acquaintances and professional networks, or the world a conflict of interests exists between parents and at large. Even where a parent believes they are sharing a conflict of interests exists between parents and at large. Even where a parent believes they are sharing their children. This conflict was clearly highlighted to a limited audience, information may be dissemi- their children. This conflict was clearly highlighted to a limited audience, information may be dissemi- in 2016 when media reports suggested an 18-year- nated further if an image is tagged, or reposted.18 in 2016 when media reports suggested an 18-year- nated further if an image is tagged, or reposted.18 old Austrian girl was suing her parents for posting old Austrian girl was suing her parents for posting embarrassing childhood photos on Facebook.10 Whilst embarrassing childhood photos on Facebook.10 Whilst that story has since been denounced as untrue,11 it that story has since been denounced as untrue,11 it nonetheless raises an interesting question: could a nonetheless raises an interesting question: could a

Communications Law Vol. 23, No. 1, 2018 7 Communications Law Vol. 23, No. 1, 2018 7 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

Sharenting: the positives disabilities have expressed concern about parents Sharenting: the positives disabilities have expressed concern about parents discussing their children’s disabilities, emphasising the discussing their children’s disabilities, emphasising the Parents sharent for many different reasons. Sharenting embarrassment they would have suffered had their Parents sharent for many different reasons. Sharenting embarrassment they would have suffered had their allows parents to broadcast their children’s achieve- parents discussed their medical condition online.36 allows parents to broadcast their children’s achieve- parents discussed their medical condition online.36 ments.19 Sharenting also helps parents to avoid There are parents who post information knowing it ments.19 Sharenting also helps parents to avoid There are parents who post information knowing it isolation, to obtain emotional, practical and social will, or might, embarrass their child.37 At least one isolation, to obtain emotional, practical and social will, or might, embarrass their child.37 At least one support,20 and to share parenting advice.21 Sharenting vlogger is believed to have lost custody of his children support,20 and to share parenting advice.21 Sharenting vlogger is believed to have lost custody of his children enables parents to enact and receive validation of because of the harm he caused by ‘pranking’ and enables parents to enact and receive validation of because of the harm he caused by ‘pranking’ and their parenting.22 Through sharenting, parents can verbally abusing them on YouTube.38 Other parents their parenting.22 Through sharenting, parents can verbally abusing them on YouTube.38 Other parents share their experiences as parents, whether good, bad have been condemned for ‘shaming’ their children share their experiences as parents, whether good, bad have been condemned for ‘shaming’ their children or frustrating.23 Certain parents (including ‘mommy online, subjecting them to humiliation as a response or frustrating.23 Certain parents (including ‘mommy online, subjecting them to humiliation as a response bloggers’ and parents whose children have complex or remedy for bad behaviour.39 bloggers’ and parents whose children have complex or remedy for bad behaviour.39 medical needs) report that sharenting affords a sense medical needs) report that sharenting affords a sense of solidarity or community, increased feelings of Online photo sharing also raises concerns. of solidarity or community, increased feelings of Online photo sharing also raises concerns. connectedness and a sense of greater wellbeing.24 Photographs and videos accompanied by information connectedness and a sense of greater wellbeing.24 Photographs and videos accompanied by information Parenting blogs also provide outlets for creativity, about a child’s school, age, or location may expose Parenting blogs also provide outlets for creativity, about a child’s school, age, or location may expose enable parents to advocate particular parenting children to online grooming.40 Even if a child’s photo- enable parents to advocate particular parenting children to online grooming.40 Even if a child’s photo- practices or philosophies, and to earn income.25 graph is not accompanied by such information the practices or philosophies, and to earn income.25 graph is not accompanied by such information the Sharenting may provide significant benefits to parents. metadata behind photographs and technologies which Sharenting may provide significant benefits to parents. metadata behind photographs and technologies which facilitate user tagging, automated facial recognition facilitate user tagging, automated facial recognition There appears to be less evidence that sharenting and the compilation of disparate pieces of informa- There appears to be less evidence that sharenting and the compilation of disparate pieces of informa- benefits children. Nonetheless, sharenting can help tion, can provide third parties with significant amounts benefits children. Nonetheless, sharenting can help tion, can provide third parties with significant amounts children develop positive networks of family and of personal information about children’s identity, children develop positive networks of family and of personal information about children’s identity, friends.26 Some parents suggest that maintenance location and friends.41 Photographs may be altered friends.26 Some parents suggest that maintenance location and friends.41 Photographs may be altered of an online record of the child’s life enables the and re-used on illegal websites.42 Even seemingly of an online record of the child’s life enables the and re-used on illegal websites.42 Even seemingly child to learn about themselves.27 Others submit that innocuous photos can affect a child’s reputation, child to learn about themselves.27 Others submit that innocuous photos can affect a child’s reputation, sharenting allows parents to build a positive social incite bullying or expose children to ridicule.43 sharenting allows parents to build a positive social incite bullying or expose children to ridicule.43 media image for children, to counteract ‘negative media image for children, to counteract ‘negative behaviours they might themselves engage in as Where private information is shared without a child’s behaviours they might themselves engage in as Where private information is shared without a child’s teenagers.’28 consent or knowledge, this may infringe their human teenagers.’28 consent or knowledge, this may infringe their human rights, including the right to privacy,44 the right to rights, including the right to privacy,44 the right to Sharenting: the negatives respect for private life,45 the right to data protection, 46 Sharenting: the negatives respect for private life,45 the right to data protection, 46 and the right to preserve one’s identity.47 Online infor- and the right to preserve one’s identity.47 Online infor- Parents have always shared stories and photos with mation sharing affects adults’ privacy too, but where Parents have always shared stories and photos with mation sharing affects adults’ privacy too, but where friends and family. Sharenting, however, takes sharing the victim is a child the need for protection is greater. friends and family. Sharenting, however, takes sharing the victim is a child the need for protection is greater. to a different level. Sharented information has a reach Paragraph 38 of the preamble to the GDPR spells to a different level. Sharented information has a reach Paragraph 38 of the preamble to the GDPR spells and longevity unimagined 20 years ago.29 Sharenting out clearly, ‘[c]hildren merit specific protection with and longevity unimagined 20 years ago.29 Sharenting out clearly, ‘[c]hildren merit specific protection with may cause children substantial embarrassment and regard to their personal data.’ may cause children substantial embarrassment and regard to their personal data.’ anxiety.30 Where third parties comment harshly upon anxiety.30 Where third parties comment harshly upon sharented information this can impact upon the sharented information this can impact upon the child’s self-respect.31 Could a child sue their parents child’s self-respect.31 Could a child sue their parents – the position in English law – the position in English law Many parents express concern about ‘oversharenting’, Many parents express concern about ‘oversharenting’, when parents share too much, or share inappro- One hopes that most children who object to when parents share too much, or share inappro- One hopes that most children who object to priate, embarrassing information.32 A 2017 Ofcom sharenting will be able to ask their parent(s) to stop priate, embarrassing information.32 A 2017 Ofcom sharenting will be able to ask their parent(s) to stop survey suggests most UK parents who sharent consider sharenting and to remove any objectionable informa- survey suggests most UK parents who sharent consider sharenting and to remove any objectionable informa- carefully who can view photos or videos and would tion.48 If a parent refuses to do so, however, several carefully who can view photos or videos and would tion.48 If a parent refuses to do so, however, several not share information their child would be unhappy civil regimes provide the child with means to seek an not share information their child would be unhappy civil regimes provide the child with means to seek an with.33 Nonetheless, parents do not always portray injunction to prohibit ongoing dissemination.49 with.33 Nonetheless, parents do not always portray injunction to prohibit ongoing dissemination.49 their children favourably. The confessional blogs of their children favourably. The confessional blogs of ‘bad’ or ‘slummy mummies,’ tell stories of frustration, The first remedy which will be considered is the law ‘bad’ or ‘slummy mummies,’ tell stories of frustration, The first remedy which will be considered is the law boredom, and parental deficiencies,34 and disclose of confidence. The law of confidence has long been boredom, and parental deficiencies,34 and disclose of confidence. The law of confidence has long been feelings parents might never reveal to their children’s used by private individuals to protect personal infor- feelings parents might never reveal to their children’s used by private individuals to protect personal infor- faces (seemingly forgetting those posts may be on mation, private images,50 details of home and family faces (seemingly forgetting those posts may be on mation, private images,50 details of home and family the internet for years).35 Some adults with chronic life51 and medical information.52 In recent years the internet for years).35 Some adults with chronic life51 and medical information.52 In recent years

8 Communications Law Vol. 23, No. 1, 2018 8 Communications Law Vol. 23, No. 1, 2018 Sharenting: balancing the conflicting rights of parents and children Sharenting: balancing the conflicting rights of parents and children this action has developed, and ‘branched off into appreciated, that it was confidential.61 this action has developed, and ‘branched off into appreciated, that it was confidential.61 two general forms.’53 Now, where a child objects to two general forms.’53 Now, where a child objects to parental sharenting, they could potentially seek an That detriment is no longer essential is perhaps fortu- parental sharenting, they could potentially seek an That detriment is no longer essential is perhaps fortu- injunction using either the classic, ‘old-fashioned’ nate. Although a child might argue that sharenting has injunction using either the classic, ‘old-fashioned’ nate. Although a child might argue that sharenting has breach of confidence action, or the newer ‘privacy- caused embarrassment, distress, or bullying, or has breach of confidence action, or the newer ‘privacy- caused embarrassment, distress, or bullying, or has related variety,’ the tort of misuse of private informa- negatively affected their mental wellbeing, sharenting related variety,’ the tort of misuse of private informa- negatively affected their mental wellbeing, sharenting tion (MOPI).54 Both regimes are considered. does not necessarily result in concrete harm. tion (MOPI).54 Both regimes are considered. does not necessarily result in concrete harm.

This article will also consider how a child might use Confidential information This article will also consider how a child might use Confidential information data protection law to enforce their right to deter- data protection law to enforce their right to determine when and how their information is shared. Where an injunction is sought the child must demon- mine when and how their information is shared. Where an injunction is sought the child must demon- Data protection, is ‘broadly analogous to the concept strate either that their parents intend to publish Data protection, is ‘broadly analogous to the concept strate either that their parents intend to publish “information privacy,”55 which effectively describes confidential information or that they have already “information privacy,”55 which effectively describes confidential information or that they have already “the claim of individuals, groups or institutions to published confidential information which should “the claim of individuals, groups or institutions to published confidential information which should determine for themselves, when, how and to what be protected by an injunction prohibiting further determine for themselves, when, how and to what be protected by an injunction prohibiting further extent information about them is communicated to disclosure. extent information about them is communicated to disclosure. others”’.56 others”’.56 Much of the information parents share details Much of the information parents share details All these regimes are as relevant to adults as to mundane aspects of everyday life. A child might not All these regimes are as relevant to adults as to mundane aspects of everyday life. A child might not children. In practice, however, the child is in a weaker consider such information to be confidential, or that children. In practice, however, the child is in a weaker consider such information to be confidential, or that position than an adult. Few children will have finan- disclosure constitutes a significant intrusion into their position than an adult. Few children will have finan- disclosure constitutes a significant intrusion into their cial means to bring court proceedings. Additionally, privacy. In any event, they cannot expect the law cial means to bring court proceedings. Additionally, privacy. In any event, they cannot expect the law before a child can bring court proceedings on their of confidence to protect ‘trivial information’ about before a child can bring court proceedings on their of confidence to protect ‘trivial information’ about own behalf they must demonstrate they have the daily life.62 Health-related information will, however, own behalf they must demonstrate they have the daily life.62 Health-related information will, however, necessary capacity to instruct a solicitor and to bring ordinarily be considered confidential.63 Given Lord necessary capacity to instruct a solicitor and to bring ordinarily be considered confidential.63 Given Lord proceedings.57 This requirement will prove particu- Buxton’s comments in McKennitt v Ash that ‘events proceedings.57 This requirement will prove particu- Buxton’s comments in McKennitt v Ash that ‘events larly challenging for younger children, who are gener- in a person’s home’ cannot be lightly intruded upon,’ larly challenging for younger children, who are gener- in a person’s home’ cannot be lightly intruded upon,’ ally assumed to lack capacity.58 We will also see that 64 certain elements of a child’s home life, particularly ally assumed to lack capacity.58 We will also see that 64 certain elements of a child’s home life, particularly where the child’s privacy has been violated by their images taken in bathrooms or bedrooms, might also where the child’s privacy has been violated by their images taken in bathrooms or bedrooms, might also parents, their legal position is potentially inferior to be deemed confidential. What is less clear is whether parents, their legal position is potentially inferior to be deemed confidential. What is less clear is whether that of a child whose privacy has been violated by a the courts would consider information about a child’s that of a child whose privacy has been violated by a the courts would consider information about a child’s stranger. activities outside the home to be confidential. stranger. activities outside the home to be confidential.

The ‘old-fashioned’ duty of confidence To bring a successful claim in confidence, the infor- The ‘old-fashioned’ duty of confidence To bring a successful claim in confidence, the information disclosed must have ‘the necessary quality of mation disclosed must have ‘the necessary quality of More than 50 years ago Megarry J detailed the three confidence about it; it must not be something which More than 50 years ago Megarry J detailed the three confidence about it; it must not be something which requirements which must be satisfied for a claim is public property and public knowledge.’65 Where requirements which must be satisfied for a claim is public property and public knowledge.’65 Where for breach of confidence to succeed. 59 The infor- children’s activities are undertaken outside the family for breach of confidence to succeed. 59 The infor- children’s activities are undertaken outside the family mation must be of a confidential nature. The infor- home and viewed by or enjoyed alongside many mation must be of a confidential nature. The infor- home and viewed by or enjoyed alongside many mation must have been imparted in circumstances other people, Woodward v Hutchins66 suggests that mation must have been imparted in circumstances other people, Woodward v Hutchins66 suggests that importing an obligation of confidence, or it must such activities might be considered either to be ‘in importing an obligation of confidence, or it must such activities might be considered either to be ‘in otherwise have been clear that the information was to the public domain’ and/or ‘shared experiences.’ Such otherwise have been clear that the information was to the public domain’ and/or ‘shared experiences.’ Such be kept confidential. Finally, there must have been an activities would not then be ‘confidential’ but might be kept confidential. Finally, there must have been an activities would not then be ‘confidential’ but might unauthorised disclosure of their information. Whilst then be considered to be ‘public knowledge’. Whilst unauthorised disclosure of their information. Whilst then be considered to be ‘public knowledge’. Whilst in Megarry J’s original formulation disclosure needed McKennitt v Ash suggests Woodward should be treated in Megarry J’s original formulation disclosure needed McKennitt v Ash suggests Woodward should be treated to be ‘to the claimant’s detriment’, subsequent case with caution,67 where a child enjoys family, school to be ‘to the claimant’s detriment’, subsequent case with caution,67 where a child enjoys family, school law refinements indicate that this is no longer neces- or sporting activities ‘in public’, with many others, law refinements indicate that this is no longer neces- or sporting activities ‘in public’, with many others, sary.60 Indeed in the 2013 Supreme Court decision in it could certainly be argued that sharing informa- sary.60 Indeed in the 2013 Supreme Court decision in it could certainly be argued that sharing informa- Vestergaard Frandsen Lord Neuberger advised that the tion about such activities does not breach any duty Vestergaard Frandsen Lord Neuberger advised that the tion about such activities does not breach any duty classic case of breach of confidence now: of confidence. However, an alternative argument can classic case of breach of confidence now: of confidence. However, an alternative argument can also be made. also be made. involves the claimant’s confidential information… involves the claimant’s confidential information… being used inconsistently with its confidential In Tchenguiz v Imerman Lord Neuberger recog- being used inconsistently with its confidential In Tchenguiz v Imerman Lord Neuberger recog- nature by a defendant, who received it in circums- nises concerns about ‘conflating the developing law nature by a defendant, who received it in circums- nises concerns about ‘conflating the developing law tances where she had agreed, or ought to have of privacy under article 8 and the traditional law of tances where she had agreed, or ought to have of privacy under article 8 and the traditional law of

Communications Law Vol. 23, No. 1, 2018 9 Communications Law Vol. 23, No. 1, 2018 9 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

confidence.’68 He suggests, nonetheless, that: longer essential to the establishment of a duty.75 To confidence.’68 He suggests, nonetheless, that: longer essential to the establishment of a duty.75 To establish whether a duty arises the court is more likely establish whether a duty arises the court is more likely the touchstone suggested by Lord Nicholls of to consider the circumstances in which the parent the touchstone suggested by Lord Nicholls of to consider the circumstances in which the parent Birkenhead and Lord Hope of Craighead in obtained the objectionable information. Certainly, Birkenhead and Lord Hope of Craighead in obtained the objectionable information. Certainly, Campbell, paragraphs [21], [85], namely whether where a child blurts information out in public or on Campbell, paragraphs [21], [85], namely whether where a child blurts information out in public or on the claimant had a ‘reasonable expectation of social media there will be no binding obligation of the claimant had a ‘reasonable expectation of social media there will be no binding obligation of privacy’69 in respect of the information in issue, is, confidence in that information. 76 It seems equally privacy’69 in respect of the information in issue, is, confidence in that information. 76 It seems equally … a good test to apply when considering whether clear that a parent could be expected to maintain … a good test to apply when considering whether clear that a parent could be expected to maintain a claim for confidence is well founded. (It chimes confidence if a child, in private, asks their parent to a claim for confidence is well founded. (It chimes confidence if a child, in private, asks their parent to well with the test suggested in classic commercial keep information ‘confidential’ or ‘secret’. Where a well with the test suggested in classic commercial keep information ‘confidential’ or ‘secret’. Where a confidence cases by Megarry J in Coco v A N Clark child expected confidences to be kept, but did not confidence cases by Megarry J in Coco v A N Clark child expected confidences to be kept, but did not (Engineers) Ltd [1969] RPC 41, page 47, namely explicitly say so a duty of confidence might also be (Engineers) Ltd [1969] RPC 41, page 47, namely explicitly say so a duty of confidence might also be whether the information had the ‘necessary quality found to exist: whether the information had the ‘necessary quality found to exist: of confidence’ and had been ‘imparted in circum- of confidence’ and had been ‘imparted in circumstances importing an obligation of confidence.’) 70 … [A] duty of confidence will arise whenever the stances importing an obligation of confidence.’) 70 … [A] duty of confidence will arise whenever the party subject to the duty is in a situation where he party subject to the duty is in a situation where he If one adopts Neuberger LJ’s approach one could knows or ought to know that the other person can If one adopts Neuberger LJ’s approach one could knows or ought to know that the other person can argue that the child will have a reasonable expec- reasonably expect his privacy to be protected.77 argue that the child will have a reasonable expec- reasonably expect his privacy to be protected.77 tation of privacy, and might furthermore found a tation of privacy, and might furthermore found a breach of confidence claim, where ‘family activi- The test is an objective one. breach of confidence claim, where ‘family activi- The test is an objective one. ties’ are conducted publicly. Whilst in Campbell, it ties’ are conducted publicly. Whilst in Campbell, it was suggested that courts will not usually consider For a duty of confidentiality to be owed … the was suggested that courts will not usually consider For a duty of confidentiality to be owed … the ordinary activities in public to be confidential or information in question must be of a nature and ordinary activities in public to be confidential or information in question must be of a nature and private,71 in contrast, in Weller and in Murray the obtained in circumstances such that any reaso- private,71 in contrast, in Weller and in Murray the obtained in circumstances such that any reaso- Court of Appeal were prepared to accept that where nable person in the position of the recipient ought Court of Appeal were prepared to accept that where nable person in the position of the recipient ought children were engaged in family activities,72 and were to recognise that it should be treated as confi- children were engaged in family activities,72 and were to recognise that it should be treated as confi- subjected to clandestine paparazzi photography, those dential. … the law would defeat its own object subjected to clandestine paparazzi photography, those dential. … the law would defeat its own object children had a reasonable expectation of privacy, if it seeks to enforce in this field standards which children had a reasonable expectation of privacy, if it seeks to enforce in this field standards which even in public. The most recent case to consider a would be rejected by the ordinary person.78 even in public. The most recent case to consider a would be rejected by the ordinary person.78 child’s expectation of privacy in public is Re JR 38,73 child’s expectation of privacy in public is Re JR 38,73 a case which saw the Supreme Court divided 3-2. A key difficulty in the sharenting context is that a case which saw the Supreme Court divided 3-2. A key difficulty in the sharenting context is that Whilst in this case the majority were not prepared to parents enjoy many of the same experiences as their Whilst in this case the majority were not prepared to parents enjoy many of the same experiences as their accept that JR’s activities (criminal rioting) fell within children. The information they share online will accept that JR’s activities (criminal rioting) fell within children. The information they share online will the ‘protected zone of interaction between a person often tell a story not only of the child’s life, but of the ‘protected zone of interaction between a person often tell a story not only of the child’s life, but of and others’, or was ‘the type of activity’ which Article the parent’s life. This poses problems for the child and others’, or was ‘the type of activity’ which Article the parent’s life. This poses problems for the child 8 protects, Lord Toulson’s comments, recognising the claimant. How does one determine where a parent’s 8 protects, Lord Toulson’s comments, recognising the claimant. How does one determine where a parent’s importance of the ‘circumstances’ in which a photo- identity ends and a child’s begins, and whether the importance of the ‘circumstances’ in which a photo- identity ends and a child’s begins, and whether the graph is taken, and the nature of the activity in which child or the parent is the owner of the sharented graph is taken, and the nature of the activity in which child or the parent is the owner of the sharented a child is involved,74 leave the door open to the possi- information?79 Parents might well argue that when a child is involved,74 leave the door open to the possi- information?79 Parents might well argue that when bility that some family interactions in public might sharenting they are breaching no duty of confidenti- bility that some family interactions in public might sharenting they are breaching no duty of confidenti- be considered subject to a reasonable expectation of ality, but are merely exercising their Article 10 right to be considered subject to a reasonable expectation of ality, but are merely exercising their Article 10 right to privacy. This does not, of course guarantee that the freedom of expression, disclosing their experiences. privacy. This does not, of course guarantee that the freedom of expression, disclosing their experiences. courts will treat information about such activities as Whilst Ms Ash unsuccessfully raised similar arguments courts will treat information about such activities as Whilst Ms Ash unsuccessfully raised similar arguments confidential, but, if not, as discussed below, the MOPI in McKennitt v Ash,80 the reality was that in McKennitt confidential, but, if not, as discussed below, the MOPI in McKennitt v Ash,80 the reality was that in McKennitt tort might alternatively be used to prevent publication the claimant was very much the focus of the disclo- tort might alternatively be used to prevent publication the claimant was very much the focus of the disclo- of information relating to such activities. sures.81 Where a parent genuinely wishes to share of information relating to such activities. sures.81 Where a parent genuinely wishes to share information about their own experiences the position information about their own experiences the position When the duty arises may be less clear. As Buxton reminds us in McKennitt When the duty arises may be less clear. As Buxton reminds us in McKennitt ‘all of these cases are fact sensitive.’82 ‘all of these cases are fact sensitive.’82 Assuming a child can prove that their information is Assuming a child can prove that their information is confidential, they must then demonstrate why their Justifying disclosure confidential, they must then demonstrate why their Justifying disclosure parent was subject to a duty of confidence. There parent was subject to a duty of confidence. There is no case law considering whether the parent-child Even if the child establishes that their parent owes is no case law considering whether the parent-child Even if the child establishes that their parent owes relationship imports an obligation of confidence. It is a duty of confidence, their claim for an injunction relationship imports an obligation of confidence. It is a duty of confidence, their claim for an injunction clear, however, that a relationship of confidence is no may still be unsuccessful if disclosure is justified. clear, however, that a relationship of confidence is no may still be unsuccessful if disclosure is justified.

10 Communications Law Vol. 23, No. 1, 2018 10 Communications Law Vol. 23, No. 1, 2018 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

Commonly defendants will justify disclosure on the Browne-Wilkinson VC indicated, ‘information only Commonly defendants will justify disclosure on the Browne-Wilkinson VC indicated, ‘information only basis that disclosure is in the public interest or that the ceases to be capable of protection as confidential basis that disclosure is in the public interest or that the ceases to be capable of protection as confidential information is in the public domain.83 when it is in fact known to a substantial number of information is in the public domain.83 when it is in fact known to a substantial number of people,’90 there is no clear agreement amongst the people,’90 there is no clear agreement amongst the To justify their sharenting a parent might argue, for judiciary as to what constitutes ‘a substantial number’ To justify their sharenting a parent might argue, for judiciary as to what constitutes ‘a substantial number’ example, that: disclosures were made in the exercise or when publication on social media constitutes example, that: disclosures were made in the exercise or when publication on social media constitutes of their freedom of expression; information is shared publication in the public domain.91 Potentially, when of their freedom of expression; information is shared publication in the public domain.91 Potentially, when with wider family for the benefit of the whole family a parent shares information with a small number of with wider family for the benefit of the whole family a parent shares information with a small number of (including the parent and child) or that disclosures Facebook friends, that information might be consid- (including the parent and child) or that disclosures Facebook friends, that information might be consid- are necessary to obtain support from family, friends ered to retain its confidential nature. If the informa- are necessary to obtain support from family, friends ered to retain its confidential nature. If the informa- or community (to benefit the child). They might tion is shared with several hundred ‘friends’ or made or community (to benefit the child). They might tion is shared with several hundred ‘friends’ or made also argue that talking about their parental experi- publicly available, the child may struggle to establish also argue that talking about their parental experi- publicly available, the child may struggle to establish ences benefits the wider community and is thus in that such information is not in the public domain. In ences benefits the wider community and is thus in that such information is not in the public domain. In the public interest. Where a defendant raises a public such a case, whilst a child might succeed in a claim the public interest. Where a defendant raises a public such a case, whilst a child might succeed in a claim interest defence they must, however, not only estab- for damages for breach of confidence, they might interest defence they must, however, not only estab- for damages for breach of confidence, they might lish that disclosure is in the public interest, but that struggle to obtain an injunction. lish that disclosure is in the public interest, but that struggle to obtain an injunction. there is a greater public interest in disclosing the there is a greater public interest in disclosing the information than in keeping the information confiden- Moreham and Warby comment that ‘[t]he limita- information than in keeping the information confiden- Moreham and Warby comment that ‘[t]he limita- tial; effectively that it ‘is in the public interest that the tion of the breach of confidence action is … that tial; effectively that it ‘is in the public interest that the tion of the breach of confidence action is … that duty of confidence should be breached’. 84 Although it does not cover information which is private but duty of confidence should be breached’. 84 Although it does not cover information which is private but none of these potential arguments has been put to the not obviously confidential nor information which none of these potential arguments has been put to the not obviously confidential nor information which courts, it seems unlikely that the parent could justify is already in the public domain.’92 This comment is courts, it seems unlikely that the parent could justify is already in the public domain.’92 This comment is breach of confidentiality where sharenting is under- clearly supported by the analysis above. Fortunately, breach of confidentiality where sharenting is under- clearly supported by the analysis above. Fortunately, taken merely to update family and friends. A parent the MOPI action offers the child a possible alternative taken merely to update family and friends. A parent the MOPI action offers the child a possible alternative might, therefore, instead choose to raise the public cause of action. might, therefore, instead choose to raise the public cause of action. domain defence. domain defence. The MOPI tort emerged out of the breach of confi- The MOPI tort emerged out of the breach of confi- Even if a child can establish that their parents have dence action, and indeed the two regimes have Even if a child can establish that their parents have dence action, and indeed the two regimes have shared confidential information, where a parent has become so entwined that it may not always seem shared confidential information, where a parent has become so entwined that it may not always seem shared that information with the world at large or has clear how they differ one from the other.93 The two shared that information with the world at large or has clear how they differ one from the other.93 The two a substantial social media following, they could argue actions nonetheless rest on different legal founda- a substantial social media following, they could argue actions nonetheless rest on different legal founda- that the information has become ‘so generally acces- tions and protect different interests, ‘secret or confi- that the information has become ‘so generally acces- tions and protect different interests, ‘secret or confi- sible’ that, it is ‘in the public domain’ and ‘cannot be dential information on the one hand and privacy on sible’ that, it is ‘in the public domain’ and ‘cannot be dential information on the one hand and privacy on regarded as confidential.’ 85 In such circumstances, the other.’94 Whilst ‘the duty of good faith’ lies at the regarded as confidential.’ 85 In such circumstances, the other.’94 Whilst ‘the duty of good faith’ lies at the the parent might argue that there is no purpose to be heart of the classic confidence action, the MOPI tort the parent might argue that there is no purpose to be heart of the classic confidence action, the MOPI tort gained from an injunction. Certainly, in Giggs (formerly focuses upon ‘protection of human autonomy and gained from an injunction. Certainly, in Giggs (formerly focuses upon ‘protection of human autonomy and CTB) v Newsgroup Newspapers Ltd and Thomas86 Eady dignity – the right to control the dissemination of CTB) v Newsgroup Newspapers Ltd and Thomas86 Eady dignity – the right to control the dissemination of J indicates that ‘the court will not attempt to prevent information about one’s private life and the right to J indicates that ‘the court will not attempt to prevent information about one’s private life and the right to publication or discussion of material that is genuinely the esteem and respect of other people.’95 Since the publication or discussion of material that is genuinely the esteem and respect of other people.’95 Since the in the public domain since, where that is so, there MOPI tort provides protection for information about in the public domain since, where that is so, there MOPI tort provides protection for information about will no longer be any confidentiality or privacy to individuals’ private lives, including information which will no longer be any confidentiality or privacy to individuals’ private lives, including information which protect.’87 would not ordinarily be considered ‘confidential’,96 protect.’87 would not ordinarily be considered ‘confidential’,96 individuals who have suffered intrusion into their individuals who have suffered intrusion into their The problem is that where information has been private lives may find it easier to satisfy the require- The problem is that where information has been private lives may find it easier to satisfy the require- viewed by a limited audience a court may not ments of the MOPI tort than breach of confidence. A viewed by a limited audience a court may not ments of the MOPI tort than breach of confidence. A consider that confidentiality has gone for all purposes. child may be able to obtain a remedy under MOPI, consider that confidentiality has gone for all purposes. child may be able to obtain a remedy under MOPI, Ultimately, it ‘is not a black and white distinc- even if their information has been and continues to Ultimately, it ‘is not a black and white distinc- even if their information has been and continues to tion between public and private’. The court will be so widely sharented no injunction for breach of tion between public and private’. The court will be so widely sharented no injunction for breach of need to consider the particular facts and decide confidence would be available.97 Indeed, PJS makes need to consider the particular facts and decide confidence would be available.97 Indeed, PJS makes whether, ‘notwithstanding some publication, there clear that repeated disclosures may constitute further whether, ‘notwithstanding some publication, there clear that repeated disclosures may constitute further remains a reasonable expectation of some privacy.’88 invasions of privacy, even where disclosures are made remains a reasonable expectation of some privacy.’88 invasions of privacy, even where disclosures are made The difficulty is compounded by the fact that ‘[t] to individuals to whom disclosure was previously The difficulty is compounded by the fact that ‘[t] to individuals to whom disclosure was previously he legal principles determining the public domain made.98 he legal principles determining the public domain made.98 proviso were formulated in a world predating social proviso were formulated in a world predating social media.’ 89 Whilst in Stephens v Avery, Sir Nicholas media.’ 89 Whilst in Stephens v Avery, Sir Nicholas

Communications Law Vol. 23, No. 1, 2018 11 Communications Law Vol. 23, No. 1, 2018 11 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

The tort of misuse of private although ‘the broad approach that must be adopted The tort of misuse of private although ‘the broad approach that must be adopted information to answering the question whether there is a reason- information to answering the question whether there is a reasonable expectation of privacy is the same for children able expectation of privacy is the same for children To succeed in their MOPI claim the child must satisfy and adults, there are several considerations which To succeed in their MOPI claim the child must satisfy and adults, there are several considerations which both limbs of a two-stage test.99 They must ﬁrst estab- are relevant to children (but not to adults) which may both limbs of a two-stage test.99 They must ﬁrst estab- are relevant to children (but not to adults) which may lish that they had/have a reasonable expectation of mean that in a particular case a child has a reasonable lish that they had/have a reasonable expectation of mean that in a particular case a child has a reasonable privacy in the information which parents have shared expectation of privacy where an adult does not.’106 privacy in the information which parents have shared expectation of privacy where an adult does not.’106 or intend to share. They must then establish that their or intend to share. They must then establish that their right to privacy prevails over their parents’ rights. In Ultimately, of course, the court will consider each right to privacy prevails over their parents’ rights. In Ultimately, of course, the court will consider each the sharenting context the application of the MOPI case on its facts, taking account of factors such as the the sharenting context the application of the MOPI case on its facts, taking account of factors such as the tests is complicated by the fact that the privacy expec- child’s age, and whether the child themselves uses tests is complicated by the fact that the privacy expec- child’s age, and whether the child themselves uses tations of children and their parents appear often to social media, or has objected to disclosure by third tations of children and their parents appear often to social media, or has objected to disclosure by third be treated as one and the same. parties such as schools or sporting organisations. It be treated as one and the same. parties such as schools or sporting organisations. It is suggested, however, that in the sharenting context is suggested, however, that in the sharenting context A reasonable expectation of privacy there is a fundamental question that the courts A reasonable expectation of privacy there is a fundamental question that the courts must also ask when considering whether a child has must also ask when considering whether a child has A child does not automatically have a reasonable reasonable expectation of privacy; is it reasonable for A child does not automatically have a reasonable reasonable expectation of privacy; is it reasonable for expectation of privacy.100 To determine whether any children to expect their parents not to sharent? expectation of privacy.100 To determine whether any children to expect their parents not to sharent? individual has a reasonable expectation of privacy individual has a reasonable expectation of privacy the court will consider ‘what a reasonable person Reasonable expectations of privacy in the the court will consider ‘what a reasonable person Reasonable expectations of privacy in the of ordinary sensibilities would feel if she was placed digital age of ordinary sensibilities would feel if she was placed digital age in the same position as the claimant and faced with in the same position as the claimant and faced with the same publicity.’101 It will take account of all the Moreham and Warby suggest that: the same publicity.’101 It will take account of all the Moreham and Warby suggest that: circumstances, including: circumstances, including: The reasonable expectation of privacy test can be The reasonable expectation of privacy test can be the attributes of the claimant, the nature of the seen, at least in part, as shorthand for whether, the attributes of the claimant, the nature of the seen, at least in part, as shorthand for whether, activity in which the claimant was engaged, the in a given situation, the protection of privacy activity in which the claimant was engaged, the in a given situation, the protection of privacy place at which it was happening, the nature and is consistent with prevailing social norms. … if place at which it was happening, the nature and is consistent with prevailing social norms. … if purpose of the intrusion, the absence of consent applied appropriately, the reasonable expectation purpose of the intrusion, the absence of consent applied appropriately, the reasonable expectation and whether it was known or could be inferred, of privacy test allows courts to ask… whether the and whether it was known or could be inferred, of privacy test allows courts to ask… whether the the effect on the claimant and the circumstances in scenario was one in which there was or should be the effect on the claimant and the circumstances in scenario was one in which there was or should be which and the purposes for which the information an objectively recognised social norm that privacy which and the purposes for which the information an objectively recognised social norm that privacy came into the hands of the publisher.102 should be respected ...107 came into the hands of the publisher.102 should be respected ...107

In Weller103 Lord Dyson considered the application Steijn explains that information sharing behaviours are In Weller103 Lord Dyson considered the application Steijn explains that information sharing behaviours are of these factors where a newspaper had taken and regulated externally by four factors; law, the market, of these factors where a newspaper had taken and regulated externally by four factors; law, the market, published photographs of three children. Concluding architecture and norms (the norms that determine what published photographs of three children. Concluding architecture and norms (the norms that determine what that the children did have a reasonable expectation kind of information is appropriate for sharing in a given that the children did have a reasonable expectation kind of information is appropriate for sharing in a given of privacy, Lord Dyson emphasised that the claimants context being termed ‘norms of appropriateness.’)108 of privacy, Lord Dyson emphasised that the claimants context being termed ‘norms of appropriateness.’)108 were children who, as children, were not in a position He explains further that it takes time for norms to were children who, as children, were not in a position He explains further that it takes time for norms to to have knowingly or accidentally laid themselves develop to accommodate new technologies.109 This to have knowingly or accidentally laid themselves develop to accommodate new technologies.109 This open to being photographed. He noted also that, for undoubtedly is the difficulty for the courts in the open to being photographed. He noted also that, for undoubtedly is the difficulty for the courts in the children, the publication of even anodyne images, sharenting context. Whilst headlines suggest ‘privacy is children, the publication of even anodyne images, sharenting context. Whilst headlines suggest ‘privacy is and the resulting potential for their identification dead’, that sharenting is the norm,110 the 2017 Ofcom and the resulting potential for their identification dead’, that sharenting is the norm,110 the 2017 Ofcom might cause harms, including embarrassment, bullying report suggests many parents still consider children can might cause harms, including embarrassment, bullying report suggests many parents still consider children can and threats to their safety and security.104 Whilst expect their information to remain private, and that and threats to their safety and security.104 Whilst expect their information to remain private, and that Weller concerned proceedings brought by celebrity parents are divided about the merits of sharenting.111 A Weller concerned proceedings brought by celebrity parents are divided about the merits of sharenting.111 A parents who had deliberately kept their children out court may struggle, therefore, to determine what ‘the parents who had deliberately kept their children out court may struggle, therefore, to determine what ‘the of the public eye, many of Lord Dyson’s comments norm’ is, and thus to conclude either that children have of the public eye, many of Lord Dyson’s comments norm’ is, and thus to conclude either that children have might be applicable to a child who objects to parental a reasonable expectation of privacy in the information might be applicable to a child who objects to parental a reasonable expectation of privacy in the information sharenting. The case of Weller, however, is also signifi- their parents hold, or that they must expect their infor- sharenting. The case of Weller, however, is also signifi- their parents hold, or that they must expect their infor- cant for other reasons. First, it is one of several cases mation to be sharented. cant for other reasons. First, it is one of several cases mation to be sharented. that recognise the special position of children, and that recognise the special position of children, and the particular harms that publicity may cause them.105 Of course, the matter is complicated by the fact that the particular harms that publicity may cause them.105 Of course, the matter is complicated by the fact that Most importantly, Lord Dyson confirms in Weller that children’s privacy expectations may be very different Most importantly, Lord Dyson confirms in Weller that children’s privacy expectations may be very different

12 Communications Law Vol. 23, No. 1, 2018 12 Communications Law Vol. 23, No. 1, 2018 Sharenting: balancing the conflicting rights of parents and children Sharenting: balancing the conflicting rights of parents and children to adults. Indeed, Steijn identifies striking differ- Dyson’s judgment in Weller is, however, a striking to adults. Indeed, Steijn identifies striking differ- Dyson’s judgment in Weller is, however, a striking ences in the normative expectations of adults and example of the judiciary’s acceptance that parents are ences in the normative expectations of adults and example of the judiciary’s acceptance that parents are children.112 Even amongst children expectations may entitled to decide what happens to their children’s children.112 Even amongst children expectations may entitled to decide what happens to their children’s vary; the expectations of children born in the past information (especially but not necessarily when they vary; the expectations of children born in the past information (especially but not necessarily when they five years may be very different to those of child are young): five years may be very different to those of child are young): born prior to the emergence of Facebook (who might born prior to the emergence of Facebook (who might validly argue that they did not expect their parents to it is parents who usually exercise this decision- validly argue that they did not expect their parents to it is parents who usually exercise this decision- share their information online). making for young children. Thus, if parents choose share their information online). making for young children. Thus, if parents choose to bring a young child onto the red carpet at a to bring a young child onto the red carpet at a The fact that a child may have different privacy premiere or awards night, it would be difficult to The fact that a child may have different privacy premiere or awards night, it would be difficult to expectations to their parents is a matter that itself also see how the child would have a reasonable expec- expectations to their parents is a matter that itself also see how the child would have a reasonable expec- requires further consideration. In a number of cases, tation of privacy or article 8 would be engaged. requires further consideration. In a number of cases, tation of privacy or article 8 would be engaged. the ECtHR and the English courts have stressed the In such circumstances, the parents have made a the ECtHR and the English courts have stressed the In such circumstances, the parents have made a importance of obtaining parental consent to publica- choice about the child’s family life and the types of importance of obtaining parental consent to publica- choice about the child’s family life and the types of tion of children’s information, acknowledging the role interactions that it will involve. A child’s reasonable tion of children’s information, acknowledging the role interactions that it will involve. A child’s reasonable of parents as consent holders or privacy stewards for expectation of privacy must be seen in the light of of parents as consent holders or privacy stewards for expectation of privacy must be seen in the light of their children. The courts appear, in some cases, to the way in which his family life is conducted.118 their children. The courts appear, in some cases, to the way in which his family life is conducted.118 also conflate the child’s expectation of privacy with also conflate the child’s expectation of privacy with the parent’s expectation of privacy for that child. This In AAA, Lord Dyson suggests further that in evalu- the parent’s expectation of privacy for that child. This In AAA, Lord Dyson suggests further that in evalu- poses potential problems in the sharenting context. ating the strength of a child claimant’s reasonable poses potential problems in the sharenting context. ating the strength of a child claimant’s reasonable expectation of privacy, a judge would be entitled to expectation of privacy, a judge would be entitled to Whose expectations? take account of any relevant conduct of parents.119 Whose expectations? take account of any relevant conduct of parents.119 Similarly in Murray Sir Anthony Clarke suggests that ‘if Similarly in Murray Sir Anthony Clarke suggests that ‘if In the cases of Reklos and Davourlis v Greece113 and the parents of a child courted publicity by procuring In the cases of Reklos and Davourlis v Greece113 and the parents of a child courted publicity by procuring Bogomolova v Russia,114 the ECtHR considered the the publication of photographs of the child in order Bogomolova v Russia,114 the ECtHR considered the the publication of photographs of the child in order failure of the Greek and Russian courts to protect the to promote their own interests, the position would or failure of the Greek and Russian courts to protect the to promote their own interests, the position would or image rights of a young baby (Reklos) and a small boy might be quite different from a case like this, where image rights of a young baby (Reklos) and a small boy might be quite different from a case like this, where (Bogomolova). In both cases, the ECtHR stresses the the parents have taken care to keep their children out (Bogomolova). In both cases, the ECtHR stresses the the parents have taken care to keep their children out importance of the parents not having given consent of the public gaze.’120 importance of the parents not having given consent of the public gaze.’120 to photographs being taken or retained (Reklos) or to photographs being taken or retained (Reklos) or published (Bogomolova). Crucially, in Reklos, the fact This line of reasoning is controversial121. It suggests published (Bogomolova). Crucially, in Reklos, the fact This line of reasoning is controversial121. It suggests that the parents had not given consent to the taking that a parent’s expectations and decisions on a that the parents had not given consent to the taking that a parent’s expectations and decisions on a of the child’s photographs led to a conclusion that child’s behalf may trump the child’s own expecta- of the child’s photographs led to a conclusion that child’s behalf may trump the child’s own expecta- the child’s Article 8 right to private life had been tions and that effectively, a child’s right to privacy the child’s Article 8 right to private life had been tions and that effectively, a child’s right to privacy breached.115 may be waived or curtailed by decisions taken by breached.115 may be waived or curtailed by decisions taken by their parents.122 Whilst in Murray and Weller, the their parents.122 Whilst in Murray and Weller, the In Reklos, where the child was a baby, it is unsur- Court of Appeal seemingly considers a claimant’s In Reklos, where the child was a baby, it is unsur- Court of Appeal seemingly considers a claimant’s prising that the ECtHR concluded both that the status as a ‘child’ to be significant, a point in their prising that the ECtHR concluded both that the status as a ‘child’ to be significant, a point in their parents should oversee the exercise of the right favour, the court’s reliance upon parents as privacy parents should oversee the exercise of the right favour, the court’s reliance upon parents as privacy to protection of their son’s image and that their stewards at the same time potentially weakens the to protection of their son’s image and that their stewards at the same time potentially weakens the prior consent to photography was indispensable.116 child’s position as a claimant. The fact that the rights prior consent to photography was indispensable.116 child’s position as a claimant. The fact that the rights Concerns, have, however been raised about such an of children are in the hands of their parents may have Concerns, have, however been raised about such an of children are in the hands of their parents may have approach. Indeed, Hughes queries: not been problematic in Reklos, Murray or Weller, but approach. Indeed, Hughes queries: not been problematic in Reklos, Murray or Weller, but it undoubtedly poses problems where older children it undoubtedly poses problems where older children at what point are children able to consent for have different privacy expectations to their parents, at what point are children able to consent for have different privacy expectations to their parents, themselves; and what is the relationship between particularly when the child wishes to preserve their themselves; and what is the relationship between particularly when the child wishes to preserve their parental consent and the child’s consent. These privacy but their parents do not.123 In Murray, Sir parental consent and the child’s consent. These privacy but their parents do not.123 In Murray, Sir questions need exploring as the Court’s blanket Anthony Clarke acknowledges that a ‘child has his questions need exploring as the Court’s blanket Anthony Clarke acknowledges that a ‘child has his assertion that consent lies with the parents has own right to respect for his privacy distinct from assertion that consent lies with the parents has own right to respect for his privacy distinct from the potential to undercut the very status of the that of his parents.’124 Subsequent decisions do not, the potential to undercut the very status of the that of his parents.’124 Subsequent decisions do not, child’s Article 8 ECHR right as a ‘right’ held by the however, adequately recognise that children have child’s Article 8 ECHR right as a ‘right’ held by the however, adequately recognise that children have child.’117 an absolute right to privacy, independent from their child.’117 an absolute right to privacy, independent from their parents, and that children should, as they mature, parents, and that children should, as they mature, To date, the English courts have not articulated how be entitled to enforce that right, irrespective of To date, the English courts have not articulated how be entitled to enforce that right, irrespective of Reklos or Bogomolova might apply in English law. Lord whether their parents value privacy.125 A child should Reklos or Bogomolova might apply in English law. Lord whether their parents value privacy.125 A child should

Communications Law Vol. 23, No. 1, 2018 13 Communications Law Vol. 23, No. 1, 2018 13 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

not, however, be denied a right to privacy, see their Nonetheless, the court considering a child’s MOPI not, however, be denied a right to privacy, see their Nonetheless, the court considering a child’s MOPI privacy expectation weakened, or their sharenting claim cannot ignore that child’s interests. As Lord privacy expectation weakened, or their sharenting claim cannot ignore that child’s interests. As Lord claim fail, simply because their parents court publicity. Dyson made clear in Weller: ‘the primacy of the claim fail, simply because their parents court publicity. Dyson made clear in Weller: ‘the primacy of the 126 best interests of a child means that, where a child’s 126 best interests of a child means that, where a child’s interests would be adversely affected, they must be interests would be adversely affected, they must be The second stage – the ultimate given considerable weight.’129 This is an approach The second stage – the ultimate given considerable weight.’129 This is an approach balancing test which accords with the requirements of Article 3 of balancing test which accords with the requirements of Article 3 of the United Nations Convention on the Rights of the the United Nations Convention on the Rights of the If the first stage of the MOPI test raises numerous Child (UNCRC), which stipulates that ‘[i]n all actions If the first stage of the MOPI test raises numerous Child (UNCRC), which stipulates that ‘[i]n all actions issues, the second is no less problematic. The MOPI concerning children, whether undertaken by public issues, the second is no less problematic. The MOPI concerning children, whether undertaken by public jurisprudence discusses at length the need to balance or private social welfare institutions, courts of law, jurisprudence discusses at length the need to balance or private social welfare institutions, courts of law, the claimant’s Article 8 rights against the defendant’s administrative authorities or legislative bodies, the best the claimant’s Article 8 rights against the defendant’s administrative authorities or legislative bodies, the best Article 10 rights. This is logical given that typically interests of the child shall be a primary consideration.’ Article 10 rights. This is logical given that typically interests of the child shall be a primary consideration.’ MOPI claims are brought by individuals against MOPI claims are brought by individuals against media defendants or against individuals who wish to The UNCRC recognises that children have particular media defendants or against individuals who wish to The UNCRC recognises that children have particular exercise their Article 10 rights to freedom of expres- vulnerabilities which justify additional protection. The exercise their Article 10 rights to freedom of expres- vulnerabilities which justify additional protection. The sion. The argument usually raised by such defendants domestic courts too are increasingly acknowledging sion. The argument usually raised by such defendants domestic courts too are increasingly acknowledging is that dissemination is required in the public interest, the importance of children’s rights, and the need to is that dissemination is required in the public interest, the importance of children’s rights, and the need to or will contribute to a debate of general interest. In protect children from the harms caused by publicity or will contribute to a debate of general interest. In protect children from the harms caused by publicity a sharenting case, a parent certainly might justify or revelation of their identity.130 In Weller, Lord Dyson a sharenting case, a parent certainly might justify or revelation of their identity.130 In Weller, Lord Dyson sharenting on the basis that they are exercising their explicitly considers the need for the child claimants sharenting on the basis that they are exercising their explicitly considers the need for the child claimants Article 10 rights. They might, however, additionally to be protected from embarrassment, bullying and Article 10 rights. They might, however, additionally to be protected from embarrassment, bullying and argue that the court should consider their Article 8 ‘potentially more serious threats to their safety’ which argue that the court should consider their Article 8 ‘potentially more serious threats to their safety’ which right to respect for family life. Article 8 offers parents might be caused by publication of their images.131 right to respect for family life. Article 8 offers parents might be caused by publication of their images.131 protection from state interference in family life, and Even in cases brought by adult claimants, the courts protection from state interference in family life, and Even in cases brought by adult claimants, the courts affords them autonomy rights, rights to determine have been willing to provide injunctive relief to affords them autonomy rights, rights to determine have been willing to provide injunctive relief to matters relating to the family’s upbringing. A parent prevent publication of information which might cause matters relating to the family’s upbringing. A parent prevent publication of information which might cause might argue that Article 8 affords them a right to these claimants’ children embarrassment or distress might argue that Article 8 affords them a right to these claimants’ children embarrassment or distress decide what information about the family they share. or result in bullying.132 Whilst there are clearly differ- decide what information about the family they share. or result in bullying.132 Whilst there are clearly differ- ences between the facts in the decided MOPI cases ences between the facts in the decided MOPI cases Article 8 v Article 10 and the sharenting case, the risks that may be posed Article 8 v Article 10 and the sharenting case, the risks that may be posed to children in the sharenting context, risks of bullying, to children in the sharenting context, risks of bullying, The Article 10 point is arguably more straightforward embarrassment and more serious threats (such as The Article 10 point is arguably more straightforward embarrassment and more serious threats (such as for the courts to determine given their long experi- approaches from those seeking to groom children), for the courts to determine given their long experi- approaches from those seeking to groom children), ence of balancing conflicting Article 8 and 10 rights. are comparable. They are of significant importance ence of balancing conflicting Article 8 and 10 rights. are comparable. They are of significant importance It is accepted practice that in such situations the court when weighing the child’s rights against the parents’ It is accepted practice that in such situations the court when weighing the child’s rights against the parents’ will resort to Lord Steyn’s guidance in Re S: Article 10 rights. will resort to Lord Steyn’s guidance in Re S: Article 10 rights.

Firstly, neither article has as such precedence over In relation to the Article 10 right to freedom of expres- Firstly, neither article has as such precedence over In relation to the Article 10 right to freedom of expres- the other. Secondly, where the values under the sion, the courts will undoubtedly consider the nature the other. Secondly, where the values under the sion, the courts will undoubtedly consider the nature two articles are in conflict, an intense focus on the of the parent’s disclosures and the contribution that two articles are in conflict, an intense focus on the of the parent’s disclosures and the contribution that comparative importance of the specific rights being they will make to debates of general interest. In most comparative importance of the specific rights being they will make to debates of general interest. In most claimed in the individual case is necessary. Thirdly, sharenting cases, parents will be making ‘low value’ claimed in the individual case is necessary. Thirdly, sharenting cases, parents will be making ‘low value’ the justifications for interfering with or restricting communications, matters of personal rather than the justifications for interfering with or restricting communications, matters of personal rather than each right must be taken into account. Finally, the public importance, which offer no contribution to each right must be taken into account. Finally, the public importance, which offer no contribution to proportionality test must be applied to each. For public debate.133 It is arguable, again, that given the proportionality test must be applied to each. For public debate.133 It is arguable, again, that given the convenience I will call this the ultimate balancing nature of the information shared by parents the courts convenience I will call this the ultimate balancing nature of the information shared by parents the courts test...127 might not consider sharenting to be in the public test...127 might not consider sharenting to be in the public interest, or at least to not outweigh the child’s right to interest, or at least to not outweigh the child’s right to Whilst neither right has precedence, it is important privacy. Whilst neither right has precedence, it is important privacy. that the claimant is a child. In proceedings under the that the claimant is a child. In proceedings under the Children Act 1989 the courts must treat the child’s The family court’s jurisprudence seems also to lend Children Act 1989 the courts must treat the child’s The family court’s jurisprudence seems also to lend welfare as a paramount consideration.128 Outside such weight to the child’s privacy claim.134 In Re J a father, welfare as a paramount consideration.128 Outside such weight to the child’s privacy claim.134 In Re J a father, proceedings no statute requires the courts, parents who objected to the removal of his fourth child proceedings no statute requires the courts, parents who objected to the removal of his fourth child or the state to treat the child’s welfare as paramount. into local authority care, used social media to share or the state to treat the child’s welfare as paramount. into local authority care, used social media to share

14 Communications Law Vol. 23, No. 1, 2018 14 Communications Law Vol. 23, No. 1, 2018 Sharenting: balancing the conflicting rights of parents and children Sharenting: balancing the conflicting rights of parents and children information about J’s removal from the family. Issuing The child’s right to a private life and the parents’ right information about J’s removal from the family. Issuing The child’s right to a private life and the parents’ right an injunction to prohibit further disclosures Munby J to respect for family life are, of course, both qualified. an injunction to prohibit further disclosures Munby J to respect for family life are, of course, both qualified. makes clear that online discussion cannot Ultimately, therefore, even if a court accepts that a makes clear that online discussion cannot Ultimately, therefore, even if a court accepts that a parent has a right to determine how their child’s infor- parent has a right to determine how their child’s infor- be allowed to go so far as to prejudice the rights mation is used, the court may nonetheless consider it be allowed to go so far as to prejudice the rights mation is used, the court may nonetheless consider it of the individual children involved. There is a appropriate to intervene where sharenting results in, of the individual children involved. There is a appropriate to intervene where sharenting results in, distinction to be drawn between, on the one hand, or poses risks to mental or physical health, or impacts distinction to be drawn between, on the one hand, or poses risks to mental or physical health, or impacts freedom to discuss the operation of the family on children’s privacy. freedom to discuss the operation of the family on children’s privacy. justice system and the conduct of individual cases justice system and the conduct of individual cases and, on the other hand, the freedom to dissemi- As Sedley LJ explained In Re F (adult: court’s and, on the other hand, the freedom to dissemi- As Sedley LJ explained In Re F (adult: court’s nate identifying particulars of specific children jurisdiction): nate identifying particulars of specific children jurisdiction): which serves to cause, or risk causing, harm to which serves to cause, or risk causing, harm to them. … Article 10 cannot be allowed to justify The family life for which Article 8 requires respect them. … Article 10 cannot be allowed to justify The family life for which Article 8 requires respect conduct which interferes with a child’s Article 8 is not a proprietary right vested in either parent conduct which interferes with a child’s Article 8 is not a proprietary right vested in either parent rights to an extent that is harmful to him.135 or child; it is as much an interest of society as rights to an extent that is harmful to him.135 or child; it is as much an interest of society as of individual family members and its principal of individual family members and its principal In Re J Munby refers to J discovering as he gets older purpose, at least where there are children, must be In Re J Munby refers to J discovering as he gets older purpose, at least where there are children, must be that ‘graphic and potentially embarrassing material … the safety and welfare of the child. … [Its] purpose, that ‘graphic and potentially embarrassing material … the safety and welfare of the child. … [Its] purpose, exists in a form accessible by the public, and which in my view, is to assure within proper limits the exists in a form accessible by the public, and which in my view, is to assure within proper limits the may be re-published at any time and for potentially entitlement of individuals to the benefit of what is may be re-published at any time and for potentially entitlement of individuals to the benefit of what is nefarious purposes.’ He highlights the potential for J to benign and positive in family life. 137 nefarious purposes.’ He highlights the potential for J to benign and positive in family life. 137 suffer bullying and other harms (including harm to J’s suffer bullying and other harms (including harm to J’s emotions and his ability to develop relationships with The jurisprudence of the ECtHR lends additional emotions and his ability to develop relationships with The jurisprudence of the ECtHR lends additional others) because of revelations concerning his involve- support to arguments that where the parent’s right others) because of revelations concerning his involve- support to arguments that where the parent’s right ment in care proceedings. Where parents knowingly to family life conflicts with the child’s best interests, ment in care proceedings. Where parents knowingly to family life conflicts with the child’s best interests, or unwittingly share intimate information about a it is the children’s best interests that are the primary or unwittingly share intimate information about a it is the children’s best interests that are the primary child’s family situation, where they disclose sensitive consideration138 or paramount.139 The question that is child’s family situation, where they disclose sensitive consideration138 or paramount.139 The question that is information about disabilities, play online ‘pranks’ on not clearly answered in any jurisprudence, however, information about disabilities, play online ‘pranks’ on not clearly answered in any jurisprudence, however, their children, or ‘shame’ then online, sharenting may is whether, the court would consider it in the child’s their children, or ‘shame’ then online, sharenting may is whether, the court would consider it in the child’s cause significant harm. Re J suggests that such children best interests to order their parents to stop sharenting cause significant harm. Re J suggests that such children best interests to order their parents to stop sharenting would have a strong argument to support removal of absent actual harm or a risk of harm, and where there would have a strong argument to support removal of absent actual harm or a risk of harm, and where there such information from the online sphere. is ‘merely’ interference with the child’s ability to such information from the online sphere. is ‘merely’ interference with the child’s ability to determine how their information is used. determine how their information is used. Article 8 v Article 8 Article 8 v Article 8 Is harm essential? Is harm essential? The English courts have not considered in the context The English courts have not considered in the context of a MOPI claim how the parental right to respect for Hughes has suggested: of a MOPI claim how the parental right to respect for Hughes has suggested: family life, which protects parents’ rights to determine family life, which protects parents’ rights to determine matters relating to the family’s upbringing, should be that the only situations in which the courts have matters relating to the family’s upbringing, should be that the only situations in which the courts have balanced against the individual privacy rights of the given serious consideration to the child’s right to balanced against the individual privacy rights of the given serious consideration to the child’s right to children. Cases such as Weller, Murray, AAA, Reklos privacy are situations in which either a high degree children. Cases such as Weller, Murray, AAA, Reklos privacy are situations in which either a high degree and Bogomolova seem to suggest that parents have of protection is afforded to that privacy-related and Bogomolova seem to suggest that parents have of protection is afforded to that privacy-related rights to determine how information relating to the interest in the adult context or where the child rights to determine how information relating to the interest in the adult context or where the child family is used and given the approach the courts have is vulnerable to a clearly identifiable harm. This family is used and given the approach the courts have is vulnerable to a clearly identifiable harm. This taken to date one must question whether any court is problematic because the right to privacy is not taken to date one must question whether any court is problematic because the right to privacy is not would be willing to condemn a parent who sharents usually, and should not be, contingent upon the would be willing to condemn a parent who sharents usually, and should not be, contingent upon the because they want to celebrate their children’s individual suffering harm. 140 because they want to celebrate their children’s individual suffering harm. 140 achievements. Many children, however, might argue achievements. Many children, however, might argue that they should be the ones to decide how their Certainly, in Weller and in Re J it is the harms to which that they should be the ones to decide how their Certainly, in Weller and in Re J it is the harms to which information is used, and not their parents. They might the children are potentially exposed (embarrass- information is used, and not their parents. They might the children are potentially exposed (embarrass- argue, further, of course that parental decisions to ment, bullying, and other ‘threats’) which seemingly argue, further, of course that parental decisions to ment, bullying, and other ‘threats’) which seemingly share family information are not always in the child’s provide justification for the court’s decision to favour share family information are not always in the child’s provide justification for the court’s decision to favour interests.136 the children’s rights over the media defendant and interests.136 the children’s rights over the media defendant and J’s father. In Murray, however, Sir Anthony Clarke J’s father. In Murray, however, Sir Anthony Clarke suggests that harm is not essential, arguing that: suggests that harm is not essential, arguing that:

Communications Law Vol. 23, No. 1, 2018 15 Communications Law Vol. 23, No. 1, 2018 15 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

one needs … to differentiate between the case Data protection one needs … to differentiate between the case Data protection where the child has for medical or some other where the child has for medical or some other personal reasons come to the knowledge of the The rules governing processing of personal data personal reasons come to the knowledge of the The rules governing processing of personal data general public and for those very reasons may be within the UK, including the sharing of information general public and for those very reasons may be within the UK, including the sharing of information particularly vulnerable to harm from intrusive press relating to a child, are detailed in the Data Protection particularly vulnerable to harm from intrusive press relating to a child, are detailed in the Data Protection exposure and the much more ordinary case… Even Act 1998 (‘the DPA’). This gives effect to European exposure and the much more ordinary case… Even Act 1998 (‘the DPA’). This gives effect to European in cases of this kind the Court is bound to have Directive 95/46/EC on the protection of individuals in cases of this kind the Court is bound to have Directive 95/46/EC on the protection of individuals regard to any particular harm (actual or prospec- with regard to the processing of personal data and regard to any particular harm (actual or prospec- with regard to the processing of personal data and tive) which the child may suffer from having his on the free movement of such data (‘the Directive’). tive) which the child may suffer from having his on the free movement of such data (‘the Directive’). image publicly displayed. But in most such cases This details certain conditions under which personal image publicly displayed. But in most such cases This details certain conditions under which personal … the child will have suffered no upset or harm. data processing may be lawfully undertaken, the … the child will have suffered no upset or harm. data processing may be lawfully undertaken, the The purpose of the claim will be to carve out for rights of individuals whose personal data is processed The purpose of the claim will be to carve out for rights of individuals whose personal data is processed the child some private space in relation to his and certain standards to which those who process the child some private space in relation to his and certain standards to which those who process public appearances. data must adhere. Where a child believes their data public appearances. data must adhere. Where a child believes their data protection rights have been infringed, their remedy protection rights have been infringed, their remedy It certainly seems wrong to expect the child to lies under the DPA, which should be interpreted in It certainly seems wrong to expect the child to lies under the DPA, which should be interpreted in establish that they have suffered or are vulnerable accordance with the Directive, to give full effect to establish that they have suffered or are vulnerable accordance with the Directive, to give full effect to to a clearly identifiable harm, because of parental the right to data protection detailed in the European to a clearly identifiable harm, because of parental the right to data protection detailed in the European sharenting. Not only are such harms not always easy Charter.145 sharenting. Not only are such harms not always easy Charter.145 to identify or quantify,141 a focus on harm may prevent to identify or quantify,141 a focus on harm may prevent a child from obtaining a remedy under the MOPI tort Obligations imposed on data controllers a child from obtaining a remedy under the MOPI tort Obligations imposed on data controllers if their only objection is to the dissemination of their by the DPA if their only objection is to the dissemination of their by the DPA private information. private information. The Directive and the DPA stipulate certain condi- The Directive and the DPA stipulate certain condi- Children value privacy, and the ability to control tions that apply when an individual processes personal Children value privacy, and the ability to control tions that apply when an individual processes personal access to their information.142 ‘Privacy serves an data. The leading European case of Lindqvist146 access to their information.142 ‘Privacy serves an data. The leading European case of Lindqvist146 important function in the development of individual confirms that where one person refers to another important function in the development of individual confirms that where one person refers to another autonomy, as the mechanism by which bound- individual on an internet page, identifying then by autonomy, as the mechanism by which bound- individual on an internet page, identifying then by aries between ourselves and others are established name or some other means, they will be processing aries between ourselves and others are established name or some other means, they will be processing and maintained.’143 Privacy is important, particu- that individual’s personal data by automatic means, and maintained.’143 Privacy is important, particu- that individual’s personal data by automatic means, larly to older children for whom privacy is more within the meaning of Article 3(1) of the Directive. larly to older children for whom privacy is more within the meaning of Article 3(1) of the Directive. central to their development and integrity, and for Accordingly, if a parent shares information online central to their development and integrity, and for Accordingly, if a parent shares information online whom, therefore, the intrusion is experienced as a which relates to and identifies their child, they will be whom, therefore, the intrusion is experienced as a which relates to and identifies their child, they will be greater violation.144 It is argued, therefore, that when considered to fall within the remit of the Directive/ greater violation.144 It is argued, therefore, that when considered to fall within the remit of the Directive/ a child brings a sharenting claim, whether the claim the DPA and will be obliged to comply with the data a child brings a sharenting claim, whether the claim the DPA and will be obliged to comply with the data is brought because the child has suffered embarrass- protection principles detailed at Schedule 1 DPA, is brought because the child has suffered embarrass- protection principles detailed at Schedule 1 DPA, ment, anxiety or hurt, or because the child simply unless one of the exemptions in Part IV of the DPA ment, anxiety or hurt, or because the child simply unless one of the exemptions in Part IV of the DPA wishes to maintain their privacy, the courts should be applies. wishes to maintain their privacy, the courts should be applies. more willing to grant an injunction to prevent or limit more willing to grant an injunction to prevent or limit disclosure than if the claimant were an adult objecting In practice, this means that when a parent shares disclosure than if the claimant were an adult objecting In practice, this means that when a parent shares to online dissemination of their private information, information about their child online they should act to online dissemination of their private information, information about their child online they should act and notwithstanding that the person who made those in accordance with the law and act ‘fairly’, letting and notwithstanding that the person who made those in accordance with the law and act ‘fairly’, letting disclosures is that child’s parent. the child know for what purposes their information is disclosures is that child’s parent. the child know for what purposes their information is being used and using the information only for those being used and using the information only for those The difficulty, of course, as noted earlier, is that even purposes. Sharenting that results in a breach of confi- The difficulty, of course, as noted earlier, is that even purposes. Sharenting that results in a breach of confi- if the courts would be minded to grant an injunc- dence or the misuse of a child’s private information if the courts would be minded to grant an injunc- dence or the misuse of a child’s private information tion to prevent sharenting, few children will have the is itself unlawful and therefore a breach of the DPA. tion to prevent sharenting, few children will have the is itself unlawful and therefore a breach of the DPA. finances to be able to bring court proceedings. Whilst If a parent has not told their child that they intend finances to be able to bring court proceedings. Whilst If a parent has not told their child that they intend this is a major issue for children who wish to enforce to share their information or photographs online, this is a major issue for children who wish to enforce to share their information or photographs online, their rights, this does not mean that such children arguably, the fair processing requirement has not their rights, this does not mean that such children arguably, the fair processing requirement has not are without remedy. One further regime exists which been satisfied. Parents should use appropriate techno- are without remedy. One further regime exists which been satisfied. Parents should use appropriate techno- also potentially affords children with a remedy against logical means to avoid unauthorised or unlawful also potentially affords children with a remedy against logical means to avoid unauthorised or unlawful ongoing sharenting. processing of that information. This is important given ongoing sharenting. processing of that information. This is important given the evidence that unscrupulous individuals may use the evidence that unscrupulous individuals may use images of children to identify and groom children, or images of children to identify and groom children, or

16 Communications Law Vol. 23, No. 1, 2018 16 Communications Law Vol. 23, No. 1, 2018 Sharenting: balancing the conflicting rights of parents and children Sharenting: balancing the conflicting rights of parents and children may manipulate images and republish them on other Remedies for non-compliance may manipulate images and republish them on other Remedies for non-compliance websites. Parents should share no more informa- websites. Parents should share no more information than is necessary, and ensure that information is The child may ask the Information Commissioner’s tion than is necessary, and ensure that information is The child may ask the Information Commissioner’s relevant, accurate and, if necessary, kept up to date. Office (‘the ICO’) to undertake an assessment to relevant, accurate and, if necessary, kept up to date. Office (‘the ICO’) to undertake an assessment to Where hundreds of childhood photographs have been determine whether their personal data is being Where hundreds of childhood photographs have been determine whether their personal data is being shared, a child might argue that parents have shared processed in breach of the DPA. 153 This costs nothing. shared, a child might argue that parents have shared processed in breach of the DPA. 153 This costs nothing. more information than is necessary. A teenager might If the ICO is satisfied that there has been a serious more information than is necessary. A teenager might If the ICO is satisfied that there has been a serious also argue that photographs of their formative years, breach of the data protection principles, the ICO may also argue that photographs of their formative years, breach of the data protection principles, the ICO may which no longer represent who they now are, are not serve a legally binding enforcement notice requiring which no longer represent who they now are, are not serve a legally binding enforcement notice requiring up to date and are being made public for longer than their parents to erase the objectionable information.154 up to date and are being made public for longer than their parents to erase the objectionable information.154 is necessary.147Finally, parents must not share informa- is necessary.147Finally, parents must not share information unless one of the conditions in Schedule 2 DPA Section 10 DPA additionally provides data subjects tion unless one of the conditions in Schedule 2 DPA Section 10 DPA additionally provides data subjects is met. If the data is sensitive personal data (informa- with a right to prevent processing likely to cause is met. If the data is sensitive personal data (informa- with a right to prevent processing likely to cause tion about racial or ethnic origin, political or religious damage or distress. Under section 10, the child may tion about racial or ethnic origin, political or religious damage or distress. Under section 10, the child may beliefs, health or criminal behaviour) at least one ask their parents, in writing, to stop posting and/ beliefs, health or criminal behaviour) at least one ask their parents, in writing, to stop posting and/ Schedule 3 condition must also be met.148 or to remove the information posted online within Schedule 3 condition must also be met.148 or to remove the information posted online within a specified period. The notice should state why the a specified period. The notice should state why the Parents will be able to satisfy a Schedule 2 condition, child believes continued online disclosure is causing Parents will be able to satisfy a Schedule 2 condition, child believes continued online disclosure is causing if their child consents to the sharenting,149 or where or likely to cause them unwarranted and substantial if their child consents to the sharenting,149 or where or likely to cause them unwarranted and substantial ‘[t]he processing is necessary for the purposes of damage or distress.155 (Whilst sharenting is unlikely ‘[t]he processing is necessary for the purposes of damage or distress.155 (Whilst sharenting is unlikely their own legitimate interests or the legitimate inter- to cause a child financial damage, the case of Google their own legitimate interests or the legitimate inter- to cause a child financial damage, the case of Google ests of those to whom the data are disclosed. (This Inc v Vidal-Hall suggested, albeit in the context of a ests of those to whom the data are disclosed. (This Inc v Vidal-Hall suggested, albeit in the context of a last condition is subject to a caveat that processing compensation claim under s 13 rather than under s last condition is subject to a caveat that processing compensation claim under s 13 rather than under s may be considered unwarranted where it is prejudi- 10, that the term ‘damage’ should be widely inter- may be considered unwarranted where it is prejudi- 10, that the term ‘damage’ should be widely inter- cial to the rights and freedoms or legitimate interests preted to incorporate distress, or ‘moral damage.’156) cial to the rights and freedoms or legitimate interests preted to incorporate distress, or ‘moral damage.’156) of the child).150 A parent might argue that they have Assuming that the child has not consented to the of the child).150 A parent might argue that they have Assuming that the child has not consented to the a legitimate interest in sharing their children’s infor- sharenting, the parent must respond within twenty- a legitimate interest in sharing their children’s infor- sharenting, the parent must respond within twenty- mation with friends and family, and/or that they are one days to confirm either that they have complied mation with friends and family, and/or that they are one days to confirm either that they have complied sharing information as permitted by their own right with, or to what extent they will comply with the sharing information as permitted by their own right with, or to what extent they will comply with the to freedom of expression. The issue then is whether request, or stating why they consider the request to freedom of expression. The issue then is whether request, or stating why they consider the request sharenting is nonetheless unwarranted because of the unjustified.157 If the parent ignores the notice, the sharenting is nonetheless unwarranted because of the unjustified.157 If the parent ignores the notice, the prejudice caused to the child’s privacy or wellbeing. child is entitled to seek court assistance. If the court is prejudice caused to the child’s privacy or wellbeing. child is entitled to seek court assistance. If the court is satisfied that the notice is justified and that the parent satisfied that the notice is justified and that the parent If a parent wishes to share sensitive personal data, failed to comply with it, the court may then order the If a parent wishes to share sensitive personal data, failed to comply with it, the court may then order the meaning Schedule 3 applies, they must addition- parent to comply with the notice, to the extent that meaning Schedule 3 applies, they must addition- parent to comply with the notice, to the extent that ally have the child’s explicit consent to sharenting,151 the court thinks fit. ally have the child’s explicit consent to sharenting,151 the court thinks fit. unless the child has already deliberately made the unless the child has already deliberately made the sharented information public.152 The child’s consent On the face of it, the DPA affords a child a real sharented information public.152 The child’s consent On the face of it, the DPA affords a child a real is thus relevant both under Schedule 2 and under chance to secure removal of sharented information is thus relevant both under Schedule 2 and under chance to secure removal of sharented information Schedule 3. One must question, however, how many and to prevent ongoing sharenting. Unfortunately, Schedule 3. One must question, however, how many and to prevent ongoing sharenting. Unfortunately, parents seek their children’s consent every time they however, success is not guaranteed: where the parents seek their children’s consent every time they however, success is not guaranteed: where the share information online, particularly if the child is personal and household exemption applies, a parent share information online, particularly if the child is personal and household exemption applies, a parent very young and lacks capacity to provide consent. may be exempted from compliance with the data very young and lacks capacity to provide consent. may be exempted from compliance with the data (Whilst parents often consent to information sharing protection principles and the requirement to satisfy (Whilst parents often consent to information sharing protection principles and the requirement to satisfy on behalf of young children there are obviously the Schedule 2 and 3 conditions. on behalf of young children there are obviously the Schedule 2 and 3 conditions. issues with parents providing consent to their own issues with parents providing consent to their own processing). Many parents may be unaware of the Article 3(2) of the Directive states that the Directive processing). Many parents may be unaware of the Article 3(2) of the Directive states that the Directive need to seek consent, or indeed to comply with any does not apply to the processing of personal data ‘by need to seek consent, or indeed to comply with any does not apply to the processing of personal data ‘by of the obligations imposed by the DPA. This does not, a natural person in the course of a purely personal of the obligations imposed by the DPA. This does not, a natural person in the course of a purely personal however, exempt a parent from compliance. or household activity.’158 The position in European however, exempt a parent from compliance. or household activity.’158 The position in European Union law is that the personal and household exemp- Union law is that the personal and household exemption outlined in Article 3(2) should be interpreted tion outlined in Article 3(2) should be interpreted narrowly. In Lindqvist the ECJ suggested the exemp- narrowly. In Lindqvist the ECJ suggested the exemption would not apply where personal information was tion would not apply where personal information was published online and made available to an indefinite published online and made available to an indefinite

Communications Law Vol. 23, No. 1, 2018 17 Communications Law Vol. 23, No. 1, 2018 17 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

number of people.159 The Article 29 Working Party160 and provides individuals with greater control over number of people.159 The Article 29 Working Party160 and provides individuals with greater control over has since suggested that it might be appropriate to their personal data.166 Although the GDPR will only be has since suggested that it might be appropriate to their personal data.166 Although the GDPR will only be distinguish between those who restrict access to a directly enforceable within the UK for a short period distinguish between those who restrict access to a directly enforceable within the UK for a short period small number of individuals (to whom the exemp- prior to the UK’s exit from the European Union, a small number of individuals (to whom the exemp- prior to the UK’s exit from the European Union, a tion applies) and those who have a high number of new Data Protection Act (currently before parlia- tion applies) and those who have a high number of new Data Protection Act (currently before parlia- contacts or allow information to be made publicly ment) will ensure that the UK affords the same protec- contacts or allow information to be made publicly ment) will ensure that the UK affords the same protec- available (who are unlikely to be able to rely upon tion to personal data as other European Union states available (who are unlikely to be able to rely upon tion to personal data as other European Union states the exemption). 161 Their approach would mean that post-Brexit. the exemption). 161 Their approach would mean that post-Brexit. parents who blog and vlog would be subject to the parents who blog and vlog would be subject to the directive whilst parents who share only with limited, The GDPR, the Data Protection Bill and directive whilst parents who share only with limited, The GDPR, the Data Protection Bill and selected ‘friends’ would be covered by the exemp- the role of social media providers selected ‘friends’ would be covered by the exemp- the role of social media providers tion. Many data protection regulators have, however, tion. Many data protection regulators have, however, adopted a stricter approach, akin to that in Lindqvist, The GDPR, in contrast to the Directive, acknowl- adopted a stricter approach, akin to that in Lindqvist, The GDPR, in contrast to the Directive, acknowl- considering all online publication to fall within the edges the importance of considering children’s considering all online publication to fall within the edges the importance of considering children’s Directive.162 In the UK, strikingly, the ICO has taken rights and vulnerabilities. Indeed, the preamble Directive.162 In the UK, strikingly, the ICO has taken rights and vulnerabilities. Indeed, the preamble an entirely different approach. paragraph 38 states that ‘[c]hildren merit specific an entirely different approach. paragraph 38 states that ‘[c]hildren merit specific protection with regard to their personal data, as they protection with regard to their personal data, as they Section 36 DPA is significantly broader than Article may be less aware of the risks, consequences and Section 36 DPA is significantly broader than Article may be less aware of the risks, consequences and 3(2), stating that ‘[p]ersonal data processed by an safeguards concerned and their rights in relation to 3(2), stating that ‘[p]ersonal data processed by an safeguards concerned and their rights in relation to individual only for the purposes of that individual’s the processing of personal data….’ The GDPR also, individual only for the purposes of that individual’s the processing of personal data….’ The GDPR also, personal, family or household affairs (including recre- however, views parents as stewards of their children’s personal, family or household affairs (including recre- however, views parents as stewards of their children’s ational purposes) are exempt from the data protec- privacy, as the people best placed to consent to use of ational purposes) are exempt from the data protec- privacy, as the people best placed to consent to use of tion principles and the provisions of Parts II and children’s information, at least until such time as the tion principles and the provisions of Parts II and children’s information, at least until such time as the III’ (author’s emphasis). The ICO’s interpretation child has capacity to consent themselves.167 Concerns III’ (author’s emphasis). The ICO’s interpretation child has capacity to consent themselves.167 Concerns broadens the exemption still further. Indeed, the have been raised that the GDPR does not appear to broadens the exemption still further. Indeed, the have been raised that the GDPR does not appear to ICO suggests that when an individual shares informa- provide children (such as those whose information is ICO suggests that when an individual shares informa- provide children (such as those whose information is tion online, in a personal capacity, purely for their sharented by their parents) with significantly increased tion online, in a personal capacity, purely for their sharented by their parents) with significantly increased own domestic or recreational purposes the exemp- protection.168 Nonetheless, delving into the detail of own domestic or recreational purposes the exemp- protection.168 Nonetheless, delving into the detail of tion will apply, irrespective of the nature of the data the GDPR, it is possible that the GDPR could provide tion will apply, irrespective of the nature of the data the GDPR, it is possible that the GDPR could provide being shared, what that data reveals, or the number children with an improved means by which to secure being shared, what that data reveals, or the number children with an improved means by which to secure of people to whom that information is revealed.163 removal of sharented information. of people to whom that information is revealed.163 removal of sharented information. Most sharenting parents will accordingly be able to Most sharenting parents will accordingly be able to rely upon the exemption, although some parents who It should first be noted that the GDPR lays much rely upon the exemption, although some parents who It should first be noted that the GDPR lays much blog primarily to earn income might still be caught by greater emphasis on the importance of obtaining blog primarily to earn income might still be caught by greater emphasis on the importance of obtaining the DPA. 164 explicit consent to the processing of personal data. the DPA. 164 explicit consent to the processing of personal data. This is important. It has been suggested that parents This is important. It has been suggested that parents For a child, based in England, who objects to should be seeking their children’s consent before they For a child, based in England, who objects to should be seeking their children’s consent before they parental sharenting, the ICO’s stance poses a signifi- sharent. Indeed Steinberg notes ‘By age four, children parental sharenting, the ICO’s stance poses a signifi- sharent. Indeed Steinberg notes ‘By age four, children cant problem. Since the ICO has made clear it ‘will have an awareness of their sense of self’ and can build cant problem. Since the ICO has made clear it ‘will have an awareness of their sense of self’ and can build not consider complaints made against individuals friendships, reason and compare themselves with not consider complaints made against individuals friendships, reason and compare themselves with who have posted personal data whilst acting in a others. She suggests further that: who have posted personal data whilst acting in a others. She suggests further that: personal capacity, no matter how unfair, deroga- personal capacity, no matter how unfair, deroga- tory or distressing the posts may be,’165 the child can Parents who post regularly can talk about the tory or distressing the posts may be,’165 the child can Parents who post regularly can talk about the obtain no remedy for sharenting through the ICO. internet with their children and should ask young obtain no remedy for sharenting through the ICO. internet with their children and should ask young One small crumb of comfort for the child can be children if they want friends and family to know One small crumb of comfort for the child can be children if they want friends and family to know found in Tugendhat J’s comments in The Law Society about the subject matter being shared. As is the found in Tugendhat J’s comments in The Law Society about the subject matter being shared. As is the v Kordowski, which suggest that the courts accept that case in many aspects of children’s rights, the v Kordowski, which suggest that the courts accept that case in many aspects of children’s rights, the online dissemination of another person’s information weight given to the child’s choice should vary with online dissemination of another person’s information weight given to the child’s choice should vary with (particularly where dissemination breaches a duty of respect to the age of the child and the information (particularly where dissemination breaches a duty of respect to the age of the child and the information confidence) may breach the DPA. being disclosed. But parents should be mindful that confidence) may breach the DPA. being disclosed. But parents should be mindful that even young children benefit from being heard and even young children benefit from being heard and Perhaps more importantly for the child, a new understood.169 Perhaps more importantly for the child, a new understood.169 General Data Protection Regulation (GDPR) replaces General Data Protection Regulation (GDPR) replaces the Directive in May 2018 introducing a new legal the Directive in May 2018 introducing a new legal regime, which strengthens the right to data protection regime, which strengthens the right to data protection

18 Communications Law Vol. 23, No. 1, 2018 18 Communications Law Vol. 23, No. 1, 2018 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

Of course, unless parents are aware of the new ‘illegal content’, namely hate speech, speech which Of course, unless parents are aware of the new ‘illegal content’, namely hate speech, speech which consent provisions they are unlikely to adopt a incites terrorism, child sexual abuse material and consent provisions they are unlikely to adopt a incites terrorism, child sexual abuse material and different approach, seeking consent from their content which infringes intellectual property rights different approach, seeking consent from their content which infringes intellectual property rights children. To ensure that children’s data protection and consumer protection. 174 It does not expect children. To ensure that children’s data protection and consumer protection. 174 It does not expect rights are effectively protected parents and children providers to remove information such as a parent rights are effectively protected parents and children providers to remove information such as a parent need to be provided with better information about might share about their child. Unsurprisingly, there- need to be provided with better information about might share about their child. Unsurprisingly, there- their rights and responsibilities. If parents do not seek fore, Facebook’s clear position is that it will not their rights and responsibilities. If parents do not seek fore, Facebook’s clear position is that it will not their children’s consent, however, or if children decide automatically remove information because someone their children’s consent, however, or if children decide automatically remove information because someone later in life that they wish to remove sharented infor- finds it disagreeable. It will remove posts, which later in life that they wish to remove sharented infor- finds it disagreeable. It will remove posts, which mation, the GDPR also affords a potential remedy for pose a genuine risk of physical harm, and posts that mation, the GDPR also affords a potential remedy for pose a genuine risk of physical harm, and posts that the child in the form of the ‘right to erasure’. might result in self-injury, bullying and harassment, the child in the form of the ‘right to erasure’. might result in self-injury, bullying and harassment, criminal activity or sexual violence and exploitation.175 criminal activity or sexual violence and exploitation.175 A right to be forgotten was included in the Directive It will, however, only remove photos and videos that A right to be forgotten was included in the Directive It will, however, only remove photos and videos that and the DPA. The scope of the revised right is, an individual reports as ‘unauthorized’ if removal is and the DPA. The scope of the revised right is, an individual reports as ‘unauthorized’ if removal is however, much wider.170 Significantly, the law no required by relevant privacy laws in the complain- however, much wider.170 Significantly, the law no required by relevant privacy laws in the complain- longer requires proof that substantial damage or ant’s country.176 As the above analysis shows, there longer requires proof that substantial damage or ant’s country.176 As the above analysis shows, there distress is likely to be caused. The right now applies is no legal provision that would explicitly require distress is likely to be caused. The right now applies is no legal provision that would explicitly require whenever a data subject withdraws consent to Facebook to remove sharented information. This is whenever a data subject withdraws consent to Facebook to remove sharented information. This is processing, where processing is no longer necessary, unfortunate. The transnational and rapidly evolving processing, where processing is no longer necessary, unfortunate. The transnational and rapidly evolving where processing is unlawful, or where the individual nature of internet services and providers pose signifi- where processing is unlawful, or where the individual nature of internet services and providers pose signifi- objects to processing and there are no overriding legit- cant challenges for the legal process. Whilst it has objects to processing and there are no overriding legit- cant challenges for the legal process. Whilst it has imate grounds for processing. been suggested that intermediaries such as Facebook, imate grounds for processing. been suggested that intermediaries such as Facebook, YouTube, Twitter and Google should be taking greater YouTube, Twitter and Google should be taking greater Fully cognisant of its obligations to comply with the ‘responsibility for children’s rights in the digital age,’177 Fully cognisant of its obligations to comply with the ‘responsibility for children’s rights in the digital age,’177 GDPR, in the Queen’s speech the government stated and some have even gone so far as to suggest that GDPR, in the Queen’s speech the government stated and some have even gone so far as to suggest that that it would introduce legislation affording individuals these organisations ‘should have a duty of care to that it would introduce legislation affording individuals these organisations ‘should have a duty of care to new rights ‘to require major social media platforms consider young children’s privacy and best interests in new rights ‘to require major social media platforms consider young children’s privacy and best interests in to delete information held about them at the age their operations’, with social media settings ‘privacy to delete information held about them at the age their operations’, with social media settings ‘privacy of 18.’171 It was of some concern to read that an respecting as default when images or information of 18.’171 It was of some concern to read that an respecting as default when images or information individual should have reached 18 years old before about young children are concerned,’178 the child individual should have reached 18 years old before about young children are concerned,’178 the child they could exercise the right to erasure, given that who objects to parental sharenting is unlikely to be they could exercise the right to erasure, given that who objects to parental sharenting is unlikely to be the DPA currently imposes no age requirements. The able to secure removal of sharented information by the DPA currently imposes no age requirements. The able to secure removal of sharented information by government has subsequently confirmed, however, contacting social media providers directly, at least not government has subsequently confirmed, however, contacting social media providers directly, at least not that there is no requirement to have reached 18 years before the improved right to erasure comes into force. that there is no requirement to have reached 18 years before the improved right to erasure comes into force. old before the right to erasure may be exercised.172 old before the right to erasure may be exercised.172 Whilst the government has not explicitly considered Whilst the government has not explicitly considered how a child might use the right to erasure to remove Alternatives to the law how a child might use the right to erasure to remove Alternatives to the law sharented information (in its August 2017 statement sharented information (in its August 2017 statement of intent its suggestion was that the right would be Whilst several legal remedies are available to children of intent its suggestion was that the right would be Whilst several legal remedies are available to children used by 18-year-olds to remove information they had who object to sharenting, none are guaranteed used by 18-year-olds to remove information they had who object to sharenting, none are guaranteed shared as children) 173 there is clearly scope to use the success and the financial costs in bringing a court shared as children) 173 there is clearly scope to use the success and the financial costs in bringing a court right for this purpose. claim are likely to be high. The emotional costs and right for this purpose. claim are likely to be high. The emotional costs and the potential damage to the family unit cannot be the potential damage to the family unit cannot be Of course, anyone can ask a social media provider ignored.179 It is perhaps for this reason that academics Of course, anyone can ask a social media provider ignored.179 It is perhaps for this reason that academics such as Facebook to remove information posted have suggested that more should be done to educate such as Facebook to remove information posted have suggested that more should be done to educate online by a third party. Given that there is no parents and children about the impact of ‘sharenting’ online by a third party. Given that there is no parents and children about the impact of ‘sharenting’ charge or requirement to prove capacity, children and the level of personal information parents are charge or requirement to prove capacity, children and the level of personal information parents are could already be using such take down procedures. exposing by sharenting.180 could already be using such take down procedures. exposing by sharenting.180 Unfortunately, however, there is no legal obligation for Unfortunately, however, there is no legal obligation for social media providers to remove the types of infor- There are alternatives to mainstream media which social media providers to remove the types of infor- There are alternatives to mainstream media which mation that children might consider objectionable or could be used by parents who wish to exercise their mation that children might consider objectionable or could be used by parents who wish to exercise their embarrassing. Although the European Commission right to share information, whilst still providing some embarrassing. Although the European Commission right to share information, whilst still providing some has made clear it expects online platforms to play protection to their children’s privacy. Messaging has made clear it expects online platforms to play protection to their children’s privacy. Messaging a proactive role in removing online content, the services such as Snapchat, where photos disap- a proactive role in removing online content, the services such as Snapchat, where photos disap- European Commission’s priority is the removal of pear, and WhatsApp which confines messages to a European Commission’s priority is the removal of pear, and WhatsApp which confines messages to a

Communications Law Vol. 23, No. 1, 2018 19 Communications Law Vol. 23, No. 1, 2018 19 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

group, have been suggested as a means to manage Conclusion group, have been suggested as a means to manage Conclusion ‘different levels of broadcasting’181 (although of course ‘different levels of broadcasting’181 (although of course screenshots of snapchat messages can be shared and Whilst parents have long shared information about screenshots of snapchat messages can be shared and Whilst parents have long shared information about photographs shared via WhatsApp are automati- their children, with friends, family and colleagues, photographs shared via WhatsApp are automati- their children, with friends, family and colleagues, cally downloaded to a recipient’s phone and thus online disclosures are of much longer lasting impact cally downloaded to a recipient’s phone and thus online disclosures are of much longer lasting impact can potentially be disseminated further). There is a and significance. How the English courts will respond can potentially be disseminated further). There is a and significance. How the English courts will respond wealth of private online social networks for families to the new phenomenon of sharenting, and the wealth of private online social networks for families to the new phenomenon of sharenting, and the (23 Snaps, Efamily, Family Wall, JustFamily, FamilyLeaf, challenges it poses to children’s privacy has yet to be (23 Snaps, Efamily, Family Wall, JustFamily, FamilyLeaf, challenges it poses to children’s privacy has yet to be MyFamily.com, Rootsy, Origami). Ammari et al seen. On the face of it a range of legal remedies are MyFamily.com, Rootsy, Origami). Ammari et al seen. On the face of it a range of legal remedies are also reported that a number of participants in their available to anyone who objects to the online dissemi- also reported that a number of participants in their available to anyone who objects to the online dissemi- research used ‘Dropbox, Google+, LiveJournal, Flickr, nation of their personal, private or confidential infor- research used ‘Dropbox, Google+, LiveJournal, Flickr, nation of their personal, private or confidential infor- Shutterfly, Snapfish, Instagram and iCloud when they mation. In practice, however, where a child’s privacy Shutterfly, Snapfish, Instagram and iCloud when they mation. In practice, however, where a child’s privacy wanted to share to smaller or more private audiences has been violated by their parents their ability to wanted to share to smaller or more private audiences has been violated by their parents their ability to than they had on Facebook.’ Others used iOS photo obtain a remedy is, in some regards, potentially more than they had on Facebook.’ Others used iOS photo obtain a remedy is, in some regards, potentially more (also perceived as more private).182 limited than that of an adult whose privacy has been (also perceived as more private).182 limited than that of an adult whose privacy has been violated by a stranger. violated by a stranger. The use of private social networks for limited The use of private social networks for limited sharing may, of course, not offer a viable alterna- Children are afforded their own rights to privacy sharing may, of course, not offer a viable alterna- Children are afforded their own rights to privacy tive to blogging, but Steinberg has suggested that it by international law. This includes a right to privacy tive to blogging, but Steinberg has suggested that it by international law. This includes a right to privacy is possible for such parents to exercise their right to against their parents. Unfortunately, it is clear that is possible for such parents to exercise their right to against their parents. Unfortunately, it is clear that freedom of expression whilst protecting their children the ECtHR and the English judiciary view parents as freedom of expression whilst protecting their children the ECtHR and the English judiciary view parents as from harmful information sharing. She suggests, for guardians of their children’s privacy rather than as from harmful information sharing. She suggests, for guardians of their children’s privacy rather than as example, that parents should: familiarise themselves privacy threats. In the sharenting context it is problem- example, that parents should: familiarise themselves privacy threats. In the sharenting context it is problem- with the privacy policies of the sites with which atic that children’s privacy expectations are inextri- with the privacy policies of the sites with which atic that children’s privacy expectations are inextri- they share; set up notifications to alert them when cably bound up with their parent’s expectations for they share; set up notifications to alert them when cably bound up with their parent’s expectations for their child’s name appears in a google search result; the child’s privacy. If children are to be able to effec- their child’s name appears in a google search result; the child’s privacy. If children are to be able to effec- consider sometimes sharing anonymously; be cautious tively use existing remedies, such as the MOPI tort, consider sometimes sharing anonymously; be cautious tively use existing remedies, such as the MOPI tort, about sharing their child’s actual location; give their to remove information which violates their privacy, about sharing their child’s actual location; give their to remove information which violates their privacy, child ‘veto power’ over online disclosures; consider English law may need to be reinterpreted to recog- child ‘veto power’ over online disclosures; consider English law may need to be reinterpreted to recog- not sharing pictures revealing their children in any nise that children have a right to privacy, ‘indepen- not sharing pictures revealing their children in any nise that children have a right to privacy, ‘indepen- state of undress; and more generally consider the dent from their parents’ privacy expectations’.188 In a state of undress; and more generally consider the dent from their parents’ privacy expectations’.188 In a effect of sharenting on their child’s current and future similar vein, the law needs to recognise that children effect of sharenting on their child’s current and future similar vein, the law needs to recognise that children sense of self and well-being.183 have a right to privacy against their parents, although sense of self and well-being.183 have a right to privacy against their parents, although this may perhaps need to be qualified according to this may perhaps need to be qualified according to Whilst there are likely to be few people who would the child’s age and capacity.189 Whilst there are likely to be few people who would the child’s age and capacity.189 disagree that an education campaign could help clarify disagree that an education campaign could help clarify the rights and responsibilities of parents and children, Undoubtedly, sharenting raises difficult issues for the the rights and responsibilities of parents and children, Undoubtedly, sharenting raises difficult issues for the questions have been raised about who should under- courts for a host of reasons. The idea that the family questions have been raised about who should under- courts for a host of reasons. The idea that the family take this crucial educative role.184 In France and should be left to govern itself, free from state interfer- take this crucial educative role.184 In France and should be left to govern itself, free from state interfer- Germany the police have used social media to advise ence, save where interference is necessary to protect Germany the police have used social media to advise ence, save where interference is necessary to protect parents of the dangers inherent in sharenting and the vulnerable family members, is a principle that has parents of the dangers inherent in sharenting and the vulnerable family members, is a principle that has need to protect the private life of minors.185 Since long underpinned English law. It is a principle that is need to protect the private life of minors.185 Since long underpinned English law. It is a principle that is sharenting is unlikely to result in commission of any recognised both in the ECHR and the UNCRC. In the sharenting is unlikely to result in commission of any recognised both in the ECHR and the UNCRC. In the criminal offence in the UK, education might perhaps sharenting context, however, it is not clear when a criminal offence in the UK, education might perhaps sharenting context, however, it is not clear when a better lie elsewhere, with government, with the ICO, parent’s right to determine how their family’s informa- better lie elsewhere, with government, with the ICO, parent’s right to determine how their family’s informa- who has a key role in upholding information rights and tion is used gives way to the child’s right to privacy. who has a key role in upholding information rights and tion is used gives way to the child’s right to privacy. already provides guidance for the public on related This is a particularly difficult issue when the informa- already provides guidance for the public on related This is a particularly difficult issue when the informa- matters, such as photography at school events,186 or tion that a parent wishes to share relates to both their matters, such as photography at school events,186 or tion that a parent wishes to share relates to both their with a body such as the UK Council for Child Internet child’s experiences and the parent’s experiences as a with a body such as the UK Council for Child Internet child’s experiences and the parent’s experiences as a Safety, which already provides guidance for parents parent and arguably belongs to both of them. When Safety, which already provides guidance for parents parent and arguably belongs to both of them. When on children’s use of social media. Since the Children’s the information relates to activities that the child has on children’s use of social media. Since the Children’s the information relates to activities that the child has Commissioner is already working with government to enjoyed, with others, in public, one can perhaps Commissioner is already working with government to enjoyed, with others, in public, one can perhaps implement a digital citizenship programme in schools, understand why some parents might consider it legiti- implement a digital citizenship programme in schools, understand why some parents might consider it legiti- guidance for children sharenting could be included mate to share that information, which will already guidance for children sharenting could be included mate to share that information, which will already within that programme.187 be known to many. Parents do, however, seem to be within that programme.187 be known to many. Parents do, however, seem to be

20 Communications Law Vol. 23, No. 1, 2018 20 Communications Law Vol. 23, No. 1, 2018 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children divided about whether and when sharenting is accept- go to court, and can demonstrate that processing has divided about whether and when sharenting is accept- go to court, and can demonstrate that processing has able. For a court applying a ‘reasonable expectation of caused them substantial damage or distress. able. For a court applying a ‘reasonable expectation of caused them substantial damage or distress. privacy’ test this is problematic. privacy’ test this is problematic. Whilst the revised right to be forgotten offers some Whilst the revised right to be forgotten offers some Undoubtedly the advent of widespread use of the hope for the future, ultimately, the best way to ensure Undoubtedly the advent of widespread use of the hope for the future, ultimately, the best way to ensure internet, and social media, poses challenges not just that parents rights and children’s rights are both internet, and social media, poses challenges not just that parents rights and children’s rights are both for the courts, but for data protection authorities respected appears to be to promote wider debate for the courts, but for data protection authorities respected appears to be to promote wider debate also. The ICO has made clear that it will not consider about the issue, ensure that parents and children also. The ICO has made clear that it will not consider about the issue, ensure that parents and children complaints about posts made on social media. This is are fully informed of the rights that are afforded to complaints about posts made on social media. This is are fully informed of the rights that are afforded to understandable – consider the number of complaints them, and encourage dialogue between parents and understandable – consider the number of complaints them, and encourage dialogue between parents and it might otherwise face. It means, however, that children at an early stage. it might otherwise face. It means, however, that children at an early stage. currently the DPA is largely ineffective at providing currently the DPA is largely ineffective at providing redress when anyone’s information is published online Claire Bessant redress when anyone’s information is published online Claire Bessant without their consent, and in breach of the data Associate Professor, School of Law without their consent, and in breach of the data Associate Professor, School of Law protection principles, unless they have the money to Northumbria University protection principles, unless they have the money to Northumbria University

Notes Notes

1 House of Lords Select Committee on Communications 2nd report ‘18-year-old sues parents for posting baby pictures on Facebook,’ 1 House of Lords Select Committee on Communications 2nd report ‘18-year-old sues parents for posting baby pictures on Facebook,’ of 2016-7 ’Growing up with the internet’ HL Paper 31 [206], USA Today, 16 September 2016; Unattributed ‘Austrian teenager of 2016-7 ’Growing up with the internet’ HL Paper 31 [206], USA Today, 16 September 2016; Unattributed ‘Austrian teenager Written evidence from Horizon Digital Economy Research, sues parents for putting her baby photos on Facebook,’ 16 Written evidence from Horizon Digital Economy Research, sues parents for putting her baby photos on Facebook,’ 16 University of Nottingham. September 2016. http://www.itv.com/news/2016-09-15/austrian- University of Nottingham. September 2016. http://www.itv.com/news/2016-09-15/austrian- 2 42% of UK parents admit to regularly sharenting, 56% of UK teenager-sues-parents-for-putting-her-baby-photos-on-facebook/ 2 42% of UK parents admit to regularly sharenting, 56% of UK teenager-sues-parents-for-putting-her-baby-photos-on-facebook/ parents never blog or post photos or videos of their children 11 Unattributed ‘Story of Austrian teen suing parents over Facebook parents never blog or post photos or videos of their children 11 Unattributed ‘Story of Austrian teen suing parents over Facebook online, and they choose not to sharent because they consider pictures debunked’ 19 September 2016 http://www.dw.com/ online, and they choose not to sharent because they consider pictures debunked’ 19 September 2016 http://www.dw.com/ their children’s lives should remain private (OFCOM, The en/story-of-austrian-teen-suing-parents-over-facebook-pictures- their children’s lives should remain private (OFCOM, The en/story-of-austrian-teen-suing-parents-over-facebook-pictures- Communications Market Report 2017 https://www.ofcom.org. debunked/a-19562265. Communications Market Report 2017 https://www.ofcom.org. debunked/a-19562265. uk/research-and-data/multi-sector-research/cmr/cmr-2017, 35). 12 Ammari et al (n 5), 1895, 1897; Steinberg, (n 6), 852. uk/research-and-data/multi-sector-research/cmr/cmr-2017, 35). 12 Ammari et al (n 5), 1895, 1897; Steinberg, (n 6), 852. 3 Megan Rose, ‘The average parent shares almost 1,500 images of 13 Priya Kumar and Sarita Schoenebeck, ‘The Modern Day Baby 3 Megan Rose, ‘The average parent shares almost 1,500 images of 13 Priya Kumar and Sarita Schoenebeck, ‘The Modern Day Baby their child online before their 5th birthday’. http://parentzone. Book: Enacting Good Mothering and Stewarding Privacy on their child online before their 5th birthday’. http://parentzone. Book: Enacting Good Mothering and Stewarding Privacy on org.uk/article/average-parent-shares-almost-1500-images-their- Facebook’ in Proceedings of the 18th ACM Conference on org.uk/article/average-parent-shares-almost-1500-images-their- Facebook’ in Proceedings of the 18th ACM Conference on child-online-their-5th-birthday Computer Supported Cooperative Work & Social Computing child-online-their-5th-birthday Computer Supported Cooperative Work & Social Computing 4 Top 10 Collins Words of the Year 2016 https://www.collinsdic- (ACM, 2015), 1302-1312, 1302. 4 Top 10 Collins Words of the Year 2016 https://www.collinsdic- (ACM, 2015), 1302-1312, 1302. tionary.com/word-lovers-blog/new/top-10-collins-words-of-the- 14 AVG Technologies (2010) ‘AVG Digital Diaries – Digital Birth’ tionary.com/word-lovers-blog/new/top-10-collins-words-of-the- 14 AVG Technologies (2010) ‘AVG Digital Diaries – Digital Birth’ year-2016,323,HCB.html. http://www.avgdigitaldiaries.com/tagged/stage_one year-2016,323,HCB.html. http://www.avgdigitaldiaries.com/tagged/stage_one 5 Tawﬁq Ammari, Priya Kumar, Cliff Lampe and Sarita 15 More than 4 million parents in the United States read or write 5 Tawﬁq Ammari, Priya Kumar, Cliff Lampe and Sarita 15 More than 4 million parents in the United States read or write Schoenebeck, ‘Managing Children’s Online Identities: How blogs, whilst in the UK Britmums maintains a network of more Schoenebeck, ‘Managing Children’s Online Identities: How blogs, whilst in the UK Britmums maintains a network of more Parents Decide What to Disclose About their Children Online’ than 15,000 blogs: Alicia Blum-Ross and Sonia Livingstone, Parents Decide What to Disclose About their Children Online’ than 15,000 blogs: Alicia Blum-Ross and Sonia Livingstone, in Proceedings of the 33rd Annual ACM Conference on Human ‘”Sharenting,” parent blogging and the boundaries of the digital in Proceedings of the 33rd Annual ACM Conference on Human ‘”Sharenting,” parent blogging and the boundaries of the digital Factors in Computing Systems, April 18-23, 2015, 1895-1904, self’ (2017) Popular Communication 15(2) 110-125, 112). Factors in Computing Systems, April 18-23, 2015, 1895-1904, self’ (2017) Popular Communication 15(2) 110-125, 112). 1896. 16 Ibid. 1896. 16 Ibid. 6 Stacey Steinberg, ‘Sharenting: Children’s Privacy in the Age of 17 Marion Oswald, Helen Ryan, Emma Nottingham, Rachael 6 Stacey Steinberg, ‘Sharenting: Children’s Privacy in the Age of 17 Marion Oswald, Helen Ryan, Emma Nottingham, Rachael Social Media’ (2017) 66 Emory LJ 839, 842. Hendry and Sophie Woodman, ‘Have “Generation Tagged” Lost Social Media’ (2017) 66 Emory LJ 839, 842. Hendry and Sophie Woodman, ‘Have “Generation Tagged” Lost 7 Article 8 General Data Protection Regulation (GDPR) authorises Their Privacy: A report on the consultation workshop to discuss 7 Article 8 General Data Protection Regulation (GDPR) authorises Their Privacy: A report on the consultation workshop to discuss parents to provide consent to the use of information society the legislative, regulatory and ethical framework surrounding parents to provide consent to the use of information society the legislative, regulatory and ethical framework surrounding services in cases where the child is deemed too young to do so the depiction of young children on digital, online and broadcast services in cases where the child is deemed too young to do so the depiction of young children on digital, online and broadcast themselves. media’, (2017) 25. themselves. media’, (2017) 25. 8 Reklos and Davourlis v Greece [2009] EMLR 16; Bogomolova v 18 Steinberg (n 6), 850; Nominet, ‘Parents “oversharing” family 8 Reklos and Davourlis v Greece [2009] EMLR 16; Bogomolova v 18 Steinberg (n 6), 850; Nominet, ‘Parents “oversharing” family Russia (App No 13812/09) judgment 20 June 2017. photos online but lack basic privacy know-how’ https://www. Russia (App No 13812/09) judgment 20 June 2017. photos online but lack basic privacy know-how’ https://www. 9 See Weller v Associated Newspapers [2015] EWCA Civ 1176; nominet.uk/parents-oversharing-family-photos-online-lack-basic- 9 See Weller v Associated Newspapers [2015] EWCA Civ 1176; nominet.uk/parents-oversharing-family-photos-online-lack-basic- AAA (by her litigation friend) v Associated Newspapers Limited privacy-know/. AAA (by her litigation friend) v Associated Newspapers Limited privacy-know/. [2013] EWCA Civ 554; Murray v Big Pictures (UK) Limited [2008] 19 Steinberg (n 6), 846. [2013] EWCA Civ 554; Murray v Big Pictures (UK) Limited [2008] 19 Steinberg (n 6), 846. EWCA Civ 446. 20 Maeve Duggan, Amanda Lenhart, Cliff Lampe and Nicole Ellison, EWCA Civ 446. 20 Maeve Duggan, Amanda Lenhart, Cliff Lampe and Nicole Ellison, 10 See Justin Huggler, ‘Austrian teenager sues parents for ‘violating ‘Parents and Social Media’ (Pew Research Center, 2015), 3; 10 See Justin Huggler, ‘Austrian teenager sues parents for ‘violating ‘Parents and Social Media’ (Pew Research Center, 2015), 3; privacy’ with childhood Facebook pictures’, The Telegraph, 14 Kumar and Schoenebeck (n 13), 1302. privacy’ with childhood Facebook pictures’, The Telegraph, 14 Kumar and Schoenebeck (n 13), 1302. September 2016 http://www.telegraph.co.uk/news/2016/09/14/ 21 Duggan et al, ibid, 4; CS Mott Children’s Hospital National Poll September 2016 http://www.telegraph.co.uk/news/2016/09/14/ 21 Duggan et al, ibid, 4; CS Mott Children’s Hospital National Poll austrian-teenager-sues-parents-for-violating-privacy-with-child/; on Children’s Health ‘Parents on Social Media: Likes and Dislikes austrian-teenager-sues-parents-for-violating-privacy-with-child/; on Children’s Health ‘Parents on Social Media: Likes and Dislikes Shehab Kahn ‘Austrian teenager sues parents for posting embar- of Sharenting (2015) 23 (2); Kumar and Schoenebeck (n 13), Shehab Kahn ‘Austrian teenager sues parents for posting embar- of Sharenting (2015) 23 (2); Kumar and Schoenebeck (n 13), rassing childhood pictures on Facebook,’ The Independent, 14 1302 and 1304. rassing childhood pictures on Facebook,’ The Independent, 14 1302 and 1304. September 2016 http://www.independent.co.uk/news/world/ 22 Kumar and Schoenebeck (n 13), 1302. September 2016 http://www.independent.co.uk/news/world/ 22 Kumar and Schoenebeck (n 13), 1302. europe/teenager-sues-parents-over-embarrassing-childhood- 23 Kate Orton-Johnson, ‘Mummy blogs and Representations of europe/teenager-sues-parents-over-embarrassing-childhood- 23 Kate Orton-Johnson, ‘Mummy blogs and Representations of pictures-on-facebook-austria-a7307561.html; Ashley May Motherhood: “Bad mummies” and their Readers’ (2017) Social pictures-on-facebook-austria-a7307561.html; Ashley May Motherhood: “Bad mummies” and their Readers’ (2017) Social

Communications Law Vol. 23, No. 1, 2018 21 Communications Law Vol. 23, No. 1, 2018 21 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

Media & Society 3(2) 1-10, 2 52 W v Egdell (1990) 2 WLR 491. Media & Society 3(2) 1-10, 2 52 W v Egdell (1990) 2 WLR 491. 24 Steinberg (n 6), 852; Kumar and Schoenebeck (n 13), 1304; 53 Rebecca Moosavian, ‘Charting the Journey from Confidence 24 Steinberg (n 6), 852; Kumar and Schoenebeck (n 13), 1304; 53 Rebecca Moosavian, ‘Charting the Journey from Confidence Orton-Johnson (n 23), 2. to the New Methodology’(2012) 34(5) EIPR 324-335, 326; Orton-Johnson (n 23), 2. to the New Methodology’(2012) 34(5) EIPR 324-335, 326; 25 Blum-Ross and Livingstone (n 15), 113. OBG v Allan; Douglas v Hello!; Mainstream Properties v Young 25 Blum-Ross and Livingstone (n 15), 113. OBG v Allan; Douglas v Hello!; Mainstream Properties v Young 26 Steinberg (n 6), 855. [2007] UKHL 21; [2007] 4 All ER 545 [255] (Lord Nicholls of 26 Steinberg (n 6), 855. [2007] UKHL 21; [2007] 4 All ER 545 [255] (Lord Nicholls of 27 Blum-Ross and Livingstone (n 15), 116. Birkenhead). 27 Blum-Ross and Livingstone (n 15), 116. Birkenhead). 28 Steinberg (n 6), 855 (Whilst this may be true, there is a potential 54 Moosavian, Ibid; Campbell v MGN [2004] UKHL 22 [14]; OBG 28 Steinberg (n 6), 855 (Whilst this may be true, there is a potential 54 Moosavian, Ibid; Campbell v MGN [2004] UKHL 22 [14]; OBG problem with this viewpoint; the parent’s portrayal of the child v Allan; Douglas v Hello!; Mainstream Properties v Young (n 69) problem with this viewpoint; the parent’s portrayal of the child v Allan; Douglas v Hello!; Mainstream Properties v Young (n 69) may not represent who the child is, or how they want to portray [251]. may not represent who the child is, or how they want to portray [251]. themselves). 55 Colin Bennett, Regulating privacy: Data protection and public themselves). 55 Colin Bennett, Regulating privacy: Data protection and public 29 Steinberg (n 6), 844. policy in Europe and the United States (Cornell University Press, 29 Steinberg (n 6), 844. policy in Europe and the United States (Cornell University Press, 30 CBBC Newsround, ‘Sharenting: Are you ok with what your 1992), 14. 30 CBBC Newsround, ‘Sharenting: Are you ok with what your 1992), 14. parents post?’ http://www.bbc.co.uk/newsround/38841469. 56 Alan Westin, Privacy and Freedom (Atheneum, 1967) 7. parents post?’ http://www.bbc.co.uk/newsround/38841469. 56 Alan Westin, Privacy and Freedom (Atheneum, 1967) 7. 31 Muge Marasli, Er Suhendan, Nergis Hazal Yilmazturk and Figen 57 Civil Procedure Rules 1998, r 21.2. 31 Muge Marasli, Er Suhendan, Nergis Hazal Yilmazturk and Figen 57 Civil Procedure Rules 1998, r 21.2. Cok, ‘Parents’ shares on Social Networking Sites About the 58 In the medical context s 8(1) Family Law Reform Act 1969 Cok, ‘Parents’ shares on Social Networking Sites About the 58 In the medical context s 8(1) Family Law Reform Act 1969 Children: Sharenting’ (2016) Anthropologist 24(2) 399, 400. confirms the right of a 16-year-old to consent to medical treat- Children: Sharenting’ (2016) Anthropologist 24(2) 399, 400. confirms the right of a 16-year-old to consent to medical treat- 32 CS Mott, Children’s Hospital National Poll on Children’s Health ment. Under-16s must prove they have ‘sufficient understanding’ 32 CS Mott, Children’s Hospital National Poll on Children’s Health ment. Under-16s must prove they have ‘sufficient understanding’ ‘Parents on Social Media: Likes and Dislikes of Sharenting (2015) (Gillick v West Norfolk and Wisbech AHA [1985] 3 WLR 830). In ‘Parents on Social Media: Likes and Dislikes of Sharenting (2015) (Gillick v West Norfolk and Wisbech AHA [1985] 3 WLR 830). In 23 (2). the data protection context, a child must demonstrate they are 23 (2). the data protection context, a child must demonstrate they are 33 Ofcom, Communications Market Report 2017, 35. ‘mature enough to understand their rights,’ are able to broadly 33 Ofcom, Communications Market Report 2017, 35. ‘mature enough to understand their rights,’ are able to broadly 34 Orton-Johnson (n 23) 2. understand the process involved, and are able to interpret the 34 Orton-Johnson (n 23) 2. understand the process involved, and are able to interpret the 35 Ibid, 5 quoting Jessica Gottlieb, ‘You’re kind of a bitch of a mom information they receive. See ICO, ‘Find out how to request your 35 Ibid, 5 quoting Jessica Gottlieb, ‘You’re kind of a bitch of a mom information they receive. See ICO, ‘Find out how to request your blogger’ http://jessicagottlieb.com/2015/03/bitch-mom-blogger/. personal information’ https://ico.org.uk/for-the-public/personal- blogger’ http://jessicagottlieb.com/2015/03/bitch-mom-blogger/. personal information’ https://ico.org.uk/for-the-public/personal- 36 Steinberg (n 6), 852. information/ Note however that in Scotland a child of twelve 36 Steinberg (n 6), 852. information/ Note however that in Scotland a child of twelve 37 Family Online Safety Institute (2015) ‘Parents, Privacy & years of age or more is presumed to be of sufficient age and 37 Family Online Safety Institute (2015) ‘Parents, Privacy & years of age or more is presumed to be of sufficient age and Technology Use,’ 22. maturity to have a general understanding of what it means to Technology Use,’ 22. maturity to have a general understanding of what it means to 38 Clint Davis ‘YouTube star DaddyOFive loses custody of kids exercise the rights afforded by the DPA (s 66 DPA). 38 Clint Davis ‘YouTube star DaddyOFive loses custody of kids exercise the rights afforded by the DPA (s 66 DPA). after complaints over ‘prank’ videos’ 2 May 2017 http://www. 59 Coco v A N Clark (Engineers) Limited [1969] FSR 415, 419. after complaints over ‘prank’ videos’ 2 May 2017 http://www. 59 Coco v A N Clark (Engineers) Limited [1969] FSR 415, 419. newschannel5.com/news/national/youtube-star-daddyofive- 60 Attorney General v Observer Ltd and others; Attorney General v newschannel5.com/news/national/youtube-star-daddyofive- 60 Attorney General v Observer Ltd and others; Attorney General v loses-custody-of-kids-after-complaints-over-prank-videos. Times Newspapers Ltd and anor (Spycatcher) (1990) 1 AC 109, loses-custody-of-kids-after-complaints-over-prank-videos. Times Newspapers Ltd and anor (Spycatcher) (1990) 1 AC 109, 39 Steinberg (n 6), 853-4; Lisa Belkin ‘Humiliating children in [281H-282A]); Terry (previously referred to as LNS) v Persons 39 Steinberg (n 6), 853-4; Lisa Belkin ‘Humiliating children in [281H-282A]); Terry (previously referred to as LNS) v Persons Public: A New Parenting Trend? https://www.huffingtonpost.com/ Unknown [2010] EWHC 119 (QB) [49] (Tugendhat J). Public: A New Parenting Trend? https://www.huffingtonpost.com/ Unknown [2010] EWHC 119 (QB) [49] (Tugendhat J). lisa-belkin/humiliating-children-to-teach-them-_b_1435315.html 61 Vestergaard Frandsen A/A (now MVF 3 ApS) v Bestnet Europe Ltd lisa-belkin/humiliating-children-to-teach-them-_b_1435315.html 61 Vestergaard Frandsen A/A (now MVF 3 ApS) v Bestnet Europe Ltd accessed 11.10.17; Valentin and Blackstock Psychology ‘The and others [2013] UKSC 31 [23] (Lord Neuberger). accessed 11.10.17; Valentin and Blackstock Psychology ‘The and others [2013] UKSC 31 [23] (Lord Neuberger). Dark Side of Public Shaming Parenting’ 16.6.2015 http://www. 62 Spycatcher (n 60) 282C-F (Goff LJ). Dark Side of Public Shaming Parenting’ 16.6.2015 http://www. 62 Spycatcher (n 60) 282C-F (Goff LJ). vbpsychology.com/the-dark-side-of-public-shaming-parenting/. 63 W v Egdell [1990] Ch 359. vbpsychology.com/the-dark-side-of-public-shaming-parenting/. 63 W v Egdell [1990] Ch 359. 40 Blum-Ross and Livingstone (n 15), 110. 64 McKennitt v Ash and ors [2006] EWCA Civ 1714 [22] (Buxton LJ). 40 Blum-Ross and Livingstone (n 15), 110. 64 McKennitt v Ash and ors [2006] EWCA Civ 1714 [22] (Buxton LJ). 41 Ammari et al, (n 5), 1896; Oswald et al (n 17), 13. 65 Saltman Engineering Co Ltd v Campbell Engineering Co Ltd (1948) 41 Ammari et al, (n 5), 1896; Oswald et al (n 17), 13. 65 Saltman Engineering Co Ltd v Campbell Engineering Co Ltd (1948) 42 BlogHer, ‘So I Posted Photos of My Kid Online and This is Where 65 RPC 203, 215. 42 BlogHer, ‘So I Posted Photos of My Kid Online and This is Where 65 RPC 203, 215. They Ended Up’ 14 February 2013 (no longer accessible) cited 66 [1977] WLR 760, 763. They Ended Up’ 14 February 2013 (no longer accessible) cited 66 [1977] WLR 760, 763. by Steinberg (n 6), 847. 67 McKennitt v Ash (n 64) [33] and [36]. by Steinberg (n 6), 847. 67 McKennitt v Ash (n 64) [33] and [36]. 43 Kelli Bender, ‘Mother of 2-year-old with rare disorder speaks out 68 [2010] EWCA Civ 908, [66] Note in Google v Vidal-Hall [2015] 43 Kelli Bender, ‘Mother of 2-year-old with rare disorder speaks out 68 [2010] EWCA Civ 908, [66] Note in Google v Vidal-Hall [2015] after internet memes make fun of her daughter’ http://people. EWCA Civ 311 [25] (referring to the comments of Lord Nicholls after internet memes make fun of her daughter’ http://people. EWCA Civ 311 [25] (referring to the comments of Lord Nicholls com/celebrity/mother-fights-cyberbullying-of-toddler-with-rare- in Campbell (n 54)) it is similarly suggested that ‘there are com/celebrity/mother-fights-cyberbullying-of-toddler-with-rare- in Campbell (n 54)) it is similarly suggested that ‘there are disorder/; Terri Parker (2013), Mean moms bash ‘ugly’ toddlers problems with an analysis which fails to distinguish between disorder/; Terri Parker (2013), Mean moms bash ‘ugly’ toddlers problems with an analysis which fails to distinguish between in secret Facebook group http://www.wpbf.com/article/mean- a breach of confidentiality and an infringement of privacy in secret Facebook group http://www.wpbf.com/article/mean- a breach of confidentiality and an infringement of privacy moms-bash-ugly-toddlers-in-secret-facebook-group/1319522 rights protected by article 8, not least because the concepts of moms-bash-ugly-toddlers-in-secret-facebook-group/1319522 rights protected by article 8, not least because the concepts of 44 Article 12, Universal Declaration of Human Rights (UDHR) and confidence and privacy are not the same and protect different 44 Article 12, Universal Declaration of Human Rights (UDHR) and confidence and privacy are not the same and protect different Article 16 United Nations Convention on the Rights of the Child interests.’ Article 16 United Nations Convention on the Rights of the Child interests.’ (UNCRC). 69 This is the first test to be satisfied where a claim is brought under (UNCRC). 69 This is the first test to be satisfied where a claim is brought under 45 Article 8, European Convention for the Protection of Human and the MOPI tort, discussed further below. 45 Article 8, European Convention for the Protection of Human and the MOPI tort, discussed further below. Rights (ECHR); Article 7 Charter of Fundamental Rights of the 70 [2010] EWCA Civ 908, [66]. Rights (ECHR); Article 7 Charter of Fundamental Rights of the 70 [2010] EWCA Civ 908, [66]. European Union (EU Charter). 71 Campbell (n 54), [154] (Lady Justice Hale). European Union (EU Charter). 71 Campbell (n 54), [154] (Lady Justice Hale). 46 Article 8, EU Charter. 72 In Weller (n 9) Lord Dyson emphasised that the children were 46 Article 8, EU Charter. 72 In Weller (n 9) Lord Dyson emphasised that the children were 47 Article 8, UNCRC. enjoying a ‘private family outing,’ an activity distinctively 47 Article 8, UNCRC. enjoying a ‘private family outing,’ an activity distinctively 48 The focus of this article is the removal of images from the different in nature to a mere trip to the shops or walk along the 48 The focus of this article is the removal of images from the different in nature to a mere trip to the shops or walk along the primary source, where it has been posted by the parent although street. primary source, where it has been posted by the parent although street. it is recognised that third parties may subsequently share images 73 [2015] UKSC 42. it is recognised that third parties may subsequently share images 73 [2015] UKSC 42. shared by parents on social media and it may not be possible for 74 In Re JR 38 [2015] UKSC 42 [100]. shared by parents on social media and it may not be possible for 74 In Re JR 38 [2015] UKSC 42 [100]. a child to remove all information/images from the internet. 75 Spycatcher (n 60)), 281D-F. a child to remove all information/images from the internet. 75 Spycatcher (n 60)), 281D-F. 49 In addition to the three main remedies discussed below, where 76 Coco v A N Clark (n 59), 420. 49 In addition to the three main remedies discussed below, where 76 Coco v A N Clark (n 59), 420. the publication of information has caused or is likely to cause 77 Campbell (n 54) [85] (Lord Hope), supported also by Lady Hale the publication of information has caused or is likely to cause 77 Campbell (n 54) [85] (Lord Hope), supported also by Lady Hale serious harm to their reputation, a child might consider using and Lord Carswell in Campbell at [134] and [165] respectively. serious harm to their reputation, a child might consider using and Lord Carswell in Campbell at [134] and [165] respectively. the Defamation Act 2013. The Protection from Harassment Act 78 Napier and Irwin Mitchell v Pressdram Ltd [2009] EWCA Civ 443 the Defamation Act 2013. The Protection from Harassment Act 78 Napier and Irwin Mitchell v Pressdram Ltd [2009] EWCA Civ 443 1997 also enables a child to seek an injunction restraining their (CA) [42] (Toulson LJ). 1997 also enables a child to seek an injunction restraining their (CA) [42] (Toulson LJ). parent from pursuing any conduct which amounts to harassment. 79 Blum-Ross and Livingstone (n 15), 111; Alicia Blum-Ross parent from pursuing any conduct which amounts to harassment. 79 Blum-Ross and Livingstone (n 15), 111; Alicia Blum-Ross 50 Prince Albert v Strange (1849) 1 Mac.& G 25. ‘Sharenting: Parental Bloggers and managing child- 50 Prince Albert v Strange (1849) 1 Mac.& G 25. ‘Sharenting: Parental Bloggers and managing child- 51 McKennitt v Ash and others [2006] EWCA Civ 171. ren’s digital footprints’ http://blogs.lse.ac.uk/ 51 McKennitt v Ash and others [2006] EWCA Civ 171. ren’s digital footprints’ http://blogs.lse.ac.uk/

22 Communications Law Vol. 23, No. 1, 2018 22 Communications Law Vol. 23, No. 1, 2018 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

parenting4digitalfuture/2015/06/17/managing-your-childs-digital- 115 Reklos (n 8) [43]. parenting4digitalfuture/2015/06/17/managing-your-childs-digital- 115 Reklos (n 8) [43]. footprint-and-or-parent-bloggers-ahead-of-brit-mums-on-the- 116 Reklos (n 8) [41] footprint-and-or-parent-bloggers-ahead-of-brit-mums-on-the- 116 Reklos (n 8) [41] 20th-of-june/. 117 Kirsty Hughes, ‘The Child’s Right to Privacy and Article 8 20th-of-june/. 117 Kirsty Hughes, ‘The Child’s Right to Privacy and Article 8 80 McKennitt v Ash (n 64). European Convention on Human Rights’ in Michael Freeman 80 McKennitt v Ash (n 64). European Convention on Human Rights’ in Michael Freeman 81 McKennitt v Ash, ibid [32, 36]. (ed) (2012) 14 Law and Childhood Studies (Oxford University 81 McKennitt v Ash, ibid [32, 36]. (ed) (2012) 14 Law and Childhood Studies (Oxford University 82 McKennitt v Ash, ibid [36]. Press, 2012) 456-86, 479. 82 McKennitt v Ash, ibid [36]. Press, 2012) 456-86, 479. 83 Terry (previously referred to as LNS) (n 60), 50 (Tugendhat J). 118 Weller (n 9) [33]. 83 Terry (previously referred to as LNS) (n 60), 50 (Tugendhat J). 118 Weller (n 9) [33]. 84 HRH Prince of Wales v Associated Newspapers Ltd [2006] EWCA 119 AAA (n 9), [21]. 84 HRH Prince of Wales v Associated Newspapers Ltd [2006] EWCA 119 AAA (n 9), [21]. Civ 1776 [68] (Lord Phillips). 120 Murray (n 9), [37-38]. Civ 1776 [68] (Lord Phillips). 120 Murray (n 9), [37-38]. 85 Spycatcher (n 60) 282C-F. 121 Oswald et al (n 17), 10. 85 Spycatcher (n 60) 282C-F. 121 Oswald et al (n 17), 10. 86 [2011] EWHC 1232. 122 See Hughes (n 117), 480; also Kirsty Hughes, ‘Publishing photo- 86 [2011] EWHC 1232. 122 See Hughes (n 117), 480; also Kirsty Hughes, ‘Publishing photo- 87 Ibid [27]. graphs without consent’ (2014) 6(2) JML 180, 185. 87 Ibid [27]. graphs without consent’ (2014) 6(2) JML 180, 185. 88 Giggs, Ibid [28] See also Douglas v Hello (No 6) [2005] EWCA 123 Hughes (n 117), 480. 88 Giggs, Ibid [28] See also Douglas v Hello (No 6) [2005] EWCA 123 Hughes (n 117), 480. Civ 595; [2006] QB 125 [55]; HRH Prince of Wales v Associated 124 Murray (n 9) [16]. Civ 595; [2006] QB 125 [55]; HRH Prince of Wales v Associated 124 Murray (n 9) [16]. Newspapers Ltd [2006] EWCA Civ 1776; Browne v Associated 125 For further discussion see Oswald et al (n 17), 10. Newspapers Ltd [2006] EWCA Civ 1776; Browne v Associated 125 For further discussion see Oswald et al (n 17), 10. Newspapers Ltd [2008] QB 103 [61] 126 Hughes (n 117), 480. Newspapers Ltd [2008] QB 103 [61] 126 Hughes (n 117), 480. 89 Max Mills ‘Sharing Privately: the effect publication on social 127 In re S (A child) [2004] UKHL 47; [2005] 1 AC 593 [17] per Lord 89 Max Mills ‘Sharing Privately: the effect publication on social 127 In re S (A child) [2004] UKHL 47; [2005] 1 AC 593 [17] per Lord media has on expectations of privacy’ (2017) JML 9(1) 45-71, 52 Steyn. media has on expectations of privacy’ (2017) JML 9(1) 45-71, 52 Steyn. citing Stephens v Avery [1998] 1 Ch 454. 128 Section 1(1) Children Act 1989. citing Stephens v Avery [1998] 1 Ch 454. 128 Section 1(1) Children Act 1989. 90 Stephens v Avery [1998] 1 Ch 454. 129 Weller (n 9) [40-41]. 90 Stephens v Avery [1998] 1 Ch 454. 129 Weller (n 9) [40-41]. 91 Mills (n 85), 53. 130 Marion Oswald, Helen James & Emma Nottingham, ‘The not-so 91 Mills (n 85), 53. 130 Marion Oswald, Helen James & Emma Nottingham, ‘The not-so 92 Nicole Moreham and Sir Mark Warby (eds), Tugendhat and secret life of five-year-olds: legal and ethical issues relating to 92 Nicole Moreham and Sir Mark Warby (eds), Tugendhat and secret life of five-year-olds: legal and ethical issues relating to Christie: The Law of Privacy and the Media ( 3rd edn, 2016), 10. disclosure of information and the depiction of children on broad- Christie: The Law of Privacy and the Media ( 3rd edn, 2016), 10. disclosure of information and the depiction of children on broad- 93 See for example comments of Lord Neuberger in Tchenguiz v cast and social media’,(2016) JML 8(2) 198-228, 216 referring 93 See for example comments of Lord Neuberger in Tchenguiz v cast and social media’,(2016) JML 8(2) 198-228, 216 referring Immerman [2010] EWCA Civ 908, [66]. to In Re S (a child) (Identification: Restrictions on Publication) Immerman [2010] EWCA Civ 908, [66]. to In Re S (a child) (Identification: Restrictions on Publication) 94 Google Inc v Vidal Hall and ors [2015] EWCA Civ 311 [25] refer- (n 118); In Re W (Identification: Restrictions on Publication) 94 Google Inc v Vidal Hall and ors [2015] EWCA Civ 311 [25] refer- (n 118); In Re W (Identification: Restrictions on Publication) ring to the comments of Lord Nicholls in Campbell (n 54). [2006] EWHC 2733 (Fam); In Re M and N (Minors) (Wardship: ring to the comments of Lord Nicholls in Campbell (n 54). [2006] EWHC 2733 (Fam); In Re M and N (Minors) (Wardship: 95 Google Inc v Vidal-Hall, ibid [25] citing Lord Hoffman in Publication of Information) [1990] Fam 211; Re Steadman [2009] 95 Google Inc v Vidal-Hall, ibid [25] citing Lord Hoffman in Publication of Information) [1990] Fam 211; Re Steadman [2009] Campbell v MGN [51]. EWHC 935 (Fam). Campbell v MGN [51]. EWHC 935 (Fam). 96 Campbell (n 54) [14]. 131 Weller (n 9) [64]. 96 Campbell (n 54) [14]. 131 Weller (n 9) [64]. 97 PJS v NJN [2016] UKSC 26 [32],[36[; see also Contostavlos v (1) 132 ETK v Newsgroup Newspapers [2011] EWCA Civ 439 [17]; PJS v 97 PJS v NJN [2016] UKSC 26 [32],[36[; see also Contostavlos v (1) 132 ETK v Newsgroup Newspapers [2011] EWCA Civ 439 [17]; PJS v Michael Mendahun (2) any person in possession or control of Newsgroup Newspapers Ltd (n 92) [44] (Lord Mance); Rocknroll Michael Mendahun (2) any person in possession or control of Newsgroup Newspapers Ltd (n 92) [44] (Lord Mance); Rocknroll material referred to in sch 2 of the order of Mr Justice Tugendhat v News Group Newspapers [2013] EWHC 24 (Ch) [36-37], [39]. material referred to in sch 2 of the order of Mr Justice Tugendhat v News Group Newspapers [2013] EWHC 24 (Ch) [36-37], [39]. dated 20 March 2012 (3) Justin Edwards [2012] EWHC 850 (QB) In PJS [72] LJ Hale makes clear that such an approach is justified dated 20 March 2012 (3) Justin Edwards [2012] EWHC 850 (QB) In PJS [72] LJ Hale makes clear that such an approach is justified [105]. as much by concern for the privacy interests of the children as [105]. as much by concern for the privacy interests of the children as 98 PJS (n 114) [32]. for the family privacy and the privacy of the parents. 98 PJS (n 114) [32]. for the family privacy and the privacy of the parents. 99 Campbell (n 54). 133 See Jacob Rowbottom, ‘’To rant, vent and converse: Protecting 99 Campbell (n 54). 133 See Jacob Rowbottom, ‘’To rant, vent and converse: Protecting 100 Weller (n 9). low level digital speech’ (2012) Cambridge Law Journal 355, 100 Weller (n 9). low level digital speech’ (2012) Cambridge Law Journal 355, 101 Campbell, (n 54) [99] Lord Hope. 356 for definitions of low and high value and low and high level 101 Campbell, (n 54) [99] Lord Hope. 356 for definitions of low and high value and low and high level 102 Murray (n 9) [36] per Sir Anthony Clarke MR. speech. 102 Murray (n 9) [36] per Sir Anthony Clarke MR. speech. 103 Weller (n 9). 134 See Re J (a child) (contra mundum injunction) [2013] EWHC 103 Weller (n 9). 134 See Re J (a child) (contra mundum injunction) [2013] EWHC 104 Weller (n 9) [56-64]. 2694 (Fam); In the matter of an application by Gloucestershire 104 Weller (n 9) [56-64]. 2694 (Fam); In the matter of an application by Gloucestershire 105 Murray (n 9) [45] and [56], Re JR 38 [2015] UKSC 42; and the County Council for the committal to prison of Matthew John 105 Murray (n 9) [45] and [56], Re JR 38 [2015] UKSC 42; and the County Council for the committal to prison of Matthew John cases of K v News Group Newspapers Ltd [2011] EWCA Civ 439 Newman [2014] EWHC 3136 (Fam); also Clayton v Clayton cases of K v News Group Newspapers Ltd [2011] EWCA Civ 439 Newman [2014] EWHC 3136 (Fam); also Clayton v Clayton and PJS v NJN [2016] UKSC 26. [2006] EWCA Civ 878. and PJS v NJN [2016] UKSC 26. [2006] EWCA Civ 878. 106 Weller (n 9) [29]; see also Murray (n 9) [57]. 135 Re J, ibid, [76(v)]. 106 Weller (n 9) [29]; see also Murray (n 9) [57]. 135 Re J, ibid, [76(v)]. 107 Moreham and Warby (n 109), 49. 136 In this regard consider the facts of Re J, ibid. 107 Moreham and Warby (n 109), 49. 136 In this regard consider the facts of Re J, ibid. 108 Wouter Martinus Petrus Steijn, ‘The role of Informational Norms 137 [2000] 2 FLR 512, 531. 108 Wouter Martinus Petrus Steijn, ‘The role of Informational Norms 137 [2000] 2 FLR 512, 531. on Social Network Sites’ 117-37 in Walrave M, Ponnet K, 138 Maumousseau and Washington v France (App No 39388/05) on Social Network Sites’ 117-37 in Walrave M, Ponnet K, 138 Maumousseau and Washington v France (App No 39388/05) Vanderhoven E, Haers J, Segaert B (eds) Youth 2.0: Social Media (unreported) 6 December 2007, ECtHR [68]; Neulinger and Vanderhoven E, Haers J, Segaert B (eds) Youth 2.0: Social Media (unreported) 6 December 2007, ECtHR [68]; Neulinger and and Adolescence (Springer, 2016), 118-9. Shuruk v Switzerland (App No 41615/07) [2011] 1 FLR 122 [134]. and Adolescence (Springer, 2016), 118-9. Shuruk v Switzerland (App No 41615/07) [2011] 1 FLR 122 [134]. 109 Steijn, ibid, 119. 139 Re R and H v United Kingdom (Application No 35348/06) [2011] 109 Steijn, ibid, 119. 139 Re R and H v United Kingdom (Application No 35348/06) [2011] 110 Alex Preston, ‘The Death of Privacy,’ The Observer, 3 August 2 FLR 1236 [73]. 110 Alex Preston, ‘The Death of Privacy,’ The Observer, 3 August 2 FLR 1236 [73]. 2014 https://www.theguardian.com/world/2014/aug/03/internet- 140 Hughes (n 117), 456. 2014 https://www.theguardian.com/world/2014/aug/03/internet- 140 Hughes (n 117), 456. death-privacy-google-facebook-alex-preston; Jo Glanville, 141 Oswald, James & Nottingham (n 130), 211. death-privacy-google-facebook-alex-preston; Jo Glanville, 141 Oswald, James & Nottingham (n 130), 211. ‘Privacy is Dead! Long live privacy’ (Sage Publications, 2011); 142 Maxine Wolfe and Robert S Laufer, ‘The Concept of ‘Privacy is Dead! Long live privacy’ (Sage Publications, 2011); 142 Maxine Wolfe and Robert S Laufer, ‘The Concept of Bobbie Johnson, ‘Privacy no longer a social norm, says Facebook Privacy in Childhood and Adolescence’ in D H Carson (ed) Bobbie Johnson, ‘Privacy no longer a social norm, says Facebook Privacy in Childhood and Adolescence’ in D H Carson (ed) founder,’ The Guardian, 11 January 2010. https://www.theguar- Man-Environment Interactions: Evaluations and Applications founder,’ The Guardian, 11 January 2010. https://www.theguar- Man-Environment Interactions: Evaluations and Applications dian.com/technology/2010/jan/11/facebook-privacy ; Business (Dowden, Hutchinson & Ross, 1975). dian.com/technology/2010/jan/11/facebook-privacy ; Business (Dowden, Hutchinson & Ross, 1975). Wire, ‘Digital Birth: Welcome to the Online World’ http:// 143 Karyn D McKinney, ‘Space Body and Mind: Parental Perceptions Wire, ‘Digital Birth: Welcome to the Online World’ http:// 143 Karyn D McKinney, ‘Space Body and Mind: Parental Perceptions www.businesswire.com/news/home/20101006006722/en/ of Children’s Privacy Needs’ (1998) Journal Fam Iss 19(1) 75, 76. www.businesswire.com/news/home/20101006006722/en/ of Children’s Privacy Needs’ (1998) Journal Fam Iss 19(1) 75, 76. Digital-Birth-Online-World. 144 Hughes (n 117), 458-9. Digital-Birth-Online-World. 144 Hughes (n 117), 458-9. 111 Leo Kelion, ‘Posting children’s photos on social media divides 145 Google v Vidal-Hall and others [2014] EWHC 13 [78]. 111 Leo Kelion, ‘Posting children’s photos on social media divides 145 Google v Vidal-Hall and others [2014] EWHC 13 [78]. nation’ BBC, 3 August 2017 http://www.bbc.co.uk/news/ 146 ECJ C101/01 [27]. nation’ BBC, 3 August 2017 http://www.bbc.co.uk/news/ 146 ECJ C101/01 [27]. technology-40804041. 147 This argument was made by a 16 year old in respect of photo- technology-40804041. 147 This argument was made by a 16 year old in respect of photo- 112 Steijn (n 108), 130. graphs taken when she was 12 (Kaye Wiggins ‘Should children 112 Steijn (n 108), 130. graphs taken when she was 12 (Kaye Wiggins ‘Should children 113 (App No 1234/05) [2009] EMLR 16 [40]. ban their parents from social media?’ http://www.bbc.co.uk/ 113 (App No 1234/05) [2009] EMLR 16 [40]. ban their parents from social media?’ http://www.bbc.co.uk/ 114 (App No 13812/09) judgment 20 June 2017 [52]. news/business-37834856). 114 (App No 13812/09) judgment 20 June 2017 [52]. news/business-37834856).

Communications Law Vol. 23, No. 1, 2018 23 Communications Law Vol. 23, No. 1, 2018 23 Sharenting: balancing the conﬂicting rights of parents and children Sharenting: balancing the conﬂicting rights of parents and children

148 Section 2, DPA. Queens_speech_2017_background_notes.pdf, 79. 148 Section 2, DPA. Queens_speech_2017_background_notes.pdf, 79. 149 Schedule 2, DPA, para 1. 172 Letter dated 19/10/2017 from Lord Ashton of Hyde and 149 Schedule 2, DPA, para 1. 172 Letter dated 19/10/2017 from Lord Ashton of Hyde and 150 Schedule 2, DPA, para 6(1). Baroness Williams of Trafford to Peers regarding issues raised 150 Schedule 2, DPA, para 6(1). Baroness Williams of Trafford to Peers regarding issues raised 151 Schedule 3, DPA, para 1. during the Second Reading of the Data Protection Bill http:// 151 Schedule 3, DPA, para 1. during the Second Reading of the Data Protection Bill http:// 152 Schedule 3, DPA, para 5. data.parliament.uk/DepositedPapers/Files/DEP2017-0603/Letter_ 152 Schedule 3, DPA, para 5. data.parliament.uk/DepositedPapers/Files/DEP2017-0603/Letter_ 153 Section 42, DPA. on_Data_Protection_Bill_from_Lord_Ashton_and_Baroness_ 153 Section 42, DPA. on_Data_Protection_Bill_from_Lord_Ashton_and_Baroness_ 154 Section 40, DPA. Williams.pdf. 154 Section 40, DPA. Williams.pdf. 155 Section 10(1), DPA. 173 Department for Digital, Culture, Media and Sport A New Data 155 Section 10(1), DPA. 173 Department for Digital, Culture, Media and Sport A New Data 156 [2015] EWCA Civ 311 [77-79]. Protection Bill: Our Planned Reforms 7 August 2017 https:// 156 [2015] EWCA Civ 311 [77-79]. Protection Bill: Our Planned Reforms 7 August 2017 https:// 157 Section 10(3), DPA. www.gov.uk/government/uploads/system/uploads/attachment_ 157 Section 10(3), DPA. www.gov.uk/government/uploads/system/uploads/attachment_ 158 Directive, Article 3(2). data/file/635900/2017-08-07_DP_Bill_-_Statement_of_Intent. 158 Directive, Article 3(2). data/file/635900/2017-08-07_DP_Bill_-_Statement_of_Intent. 159 ECJ C101/01 [27]. pdf , 8. 159 ECJ C101/01 [27]. pdf , 8. 160 Composed of representatives from each of the data protection 174 Communication Tackling illegal content online https:// 160 Composed of representatives from each of the data protection 174 Communication Tackling illegal content online https:// authorities across the European Union. ec.europa.eu/digital-single-market/en/illegal-content-online- authorities across the European Union. ec.europa.eu/digital-single-market/en/illegal-content-online- 161 Article 29 Data Protection Working Party (2009), ‘Opinion platforms#Communication on tackling illegal content online. 161 Article 29 Data Protection Working Party (2009), ‘Opinion platforms#Communication on tackling illegal content online. 5/2009 on online social networking’ 00189/09/EN WP 163, 175 https://www.facebook.com/communitystandards/ NB however 5/2009 on online social networking’ 00189/09/EN WP 163, 175 https://www.facebook.com/communitystandards/ NB however adopted 12 June 2009. that the article by Nick Hopkins ‘Revealed: Facebook’s internal adopted 12 June 2009. that the article by Nick Hopkins ‘Revealed: Facebook’s internal 162 David Erdos, ‘Beyond ॔Having a Domestic॓? Regulatory rulebook on sex, terrorism and violence’ The Guardian 21 162 David Erdos, ‘Beyond ॔Having a Domestic॓? Regulatory rulebook on sex, terrorism and violence’ The Guardian 21 Interpretation of European Data Protection Law and Individual May 2017 https://www.theguardian.com/news/2017/may/21/ Interpretation of European Data Protection Law and Individual May 2017 https://www.theguardian.com/news/2017/may/21/ Publication’ University of Cambridge Faculty of Law Research revealed-facebook-internal-rulebook-sex-terrorism-violence Publication’ University of Cambridge Faculty of Law Research revealed-facebook-internal-rulebook-sex-terrorism-violence Paper No. 54/2016 https://papers.ssrn.com/sol3/papers. suggests removal of such hateful, hurtful or violent content is by Paper No. 54/2016 https://papers.ssrn.com/sol3/papers. suggests removal of such hateful, hurtful or violent content is by cfm?abstract_id=2847628 3; Douwe Korff, (2010) ‘Comparative no means guaranteed. cfm?abstract_id=2847628 3; Douwe Korff, (2010) ‘Comparative no means guaranteed. Study on Different Approaches to new privacy challenges, in 176 https://www.facebook.com/help/428478523862899 accessed Study on Different Approaches to new privacy challenges, in 176 https://www.facebook.com/help/428478523862899 accessed particular in the light of technological developments, Working 9.10.17. particular in the light of technological developments, Working 9.10.17. paper no 2: Data protection laws in the EU: The difficulties in 177 Sonia Livingston, John Carr and Jasmina Byrne, ‘One in Three: paper no 2: Data protection laws in the EU: The difficulties in 177 Sonia Livingston, John Carr and Jasmina Byrne, ‘One in Three: meeting the challenges posed by global social and technical Internet Governance and Children’s Rights’ Global Commission meeting the challenges posed by global social and technical Internet Governance and Children’s Rights’ Global Commission developments’, 9 on Internet Governance’ (2015), 13-14. developments’, 9 on Internet Governance’ (2015), 13-14. 163 ICO (2014) ‘Social networking and online forums – when does 178 Oswald et al (n 17), 6-7. 163 ICO (2014) ‘Social networking and online forums – when does 178 Oswald et al (n 17), 6-7. the DPA apply?’ V1.1, 4. 179 Benjamin Shmueli and Ayelet Blecher-Prigat, ‘Privacy for the DPA apply?’ V1.1, 4. 179 Benjamin Shmueli and Ayelet Blecher-Prigat, ‘Privacy for 164 Ibid, 9 Children’ (2011) 42 Colum Hum Rts L Rev 759, 793-5. 164 Ibid, 9 Children’ (2011) 42 Colum Hum Rts L Rev 759, 793-5. 165 Ibid, 15 180 Oswald et al (n 17), 30. 165 Ibid, 15 180 Oswald et al (n 17), 30. 166 European Commission ‘Press Release: Agreement on 181 Geraldine Bedell, ‘The Digital Family’, Parentzone (2015) 166 European Commission ‘Press Release: Agreement on 181 Geraldine Bedell, ‘The Digital Family’, Parentzone (2015) Commission’s EU Data Protection Reform will boost Single 16 https://parentzone.org.uk/system/files/attachments/ Commission’s EU Data Protection Reform will boost Single 16 https://parentzone.org.uk/system/files/attachments/ Digital Market, Brussels, December 2015 http://europa.eu/rapid/ DF%20Report_FINAL2016_0.pdf. Digital Market, Brussels, December 2015 http://europa.eu/rapid/ DF%20Report_FINAL2016_0.pdf. press-release_IP-15-6321_en.htm. 182 Ammari et al (n 5), 1900. press-release_IP-15-6321_en.htm. 182 Ammari et al (n 5), 1900. 167 Article 8 GDPR specifies that consent to processing of children’s 183 Steinberg (n 6), 877-82. 167 Article 8 GDPR specifies that consent to processing of children’s 183 Steinberg (n 6), 877-82. data on ‘information society services’, will be lawful only if the 184 Oswald et al (n 17), 30. data on ‘information society services’, will be lawful only if the 184 Oswald et al (n 17), 30. child’s parents consent or the child is of sufficient age to do so 185 ‘Gendarmerie nationale ‘[PREVENTION: Preserver vos child’s parents consent or the child is of sufficient age to do so 185 ‘Gendarmerie nationale ‘[PREVENTION: Preserver vos themselves. The GDPR sets a maximum age of 16 but permits enfants!’ (Prevention: Protect your Children!) 23 February themselves. The GDPR sets a maximum age of 16 but permits enfants!’ (Prevention: Protect your Children!) 23 February states to authorise a child to consent at a lower age of 13, and 2015 https://www.facebook.com/gendarmerienationale/ states to authorise a child to consent at a lower age of 13, and 2015 https://www.facebook.com/gendarmerienationale/ the data protection bill currently before parliament confirms that posts/1046288785435316; Polizei Nordrhein-Westfalen (NRW) the data protection bill currently before parliament confirms that posts/1046288785435316; Polizei Nordrhein-Westfalen (NRW) in the UK a child may consent if aged 13 or over. Hagen 13 October 2015 https://www.facebook.com/Polizei. in the UK a child may consent if aged 13 or over. Hagen 13 October 2015 https://www.facebook.com/Polizei. 168 Oswald, James and Nottingham (n 130), 209. NRW.HA/posts/474114729427503:0. 168 Oswald, James and Nottingham (n 130), 209. NRW.HA/posts/474114729427503:0. 169 Steinberg (n 6), 881. 186 Information Commissioner’s Office, ‘Taking photographs in 169 Steinberg (n 6), 881. 186 Information Commissioner’s Office, ‘Taking photographs in 170 Article 17 GDPR. schools’ (2014). 170 Article 17 GDPR. schools’ (2014). 171 The Queen’s Speech and Associated Background Briefing, 187 Children’s Commissioner, ‘Our Work: Digital’ https://www.child- 171 The Queen’s Speech and Associated Background Briefing, 187 Children’s Commissioner, ‘Our Work: Digital’ https://www.child- on the Occasion of the Opening of Parliament on renscommissioner.gov.uk/our-work/digital/. on the Occasion of the Opening of Parliament on renscommissioner.gov.uk/our-work/digital/. Wednesday 21 June 2017https://www.gov.uk/government/ 188 Oswald et al (n 17), 5. Wednesday 21 June 2017https://www.gov.uk/government/ 188 Oswald et al (n 17), 5. uploads/system/uploads/attachment_data/file/620838/ 189 Shmueli and Blecher-Prigat (n 169), 763. uploads/system/uploads/attachment_data/file/620838/ 189 Shmueli and Blecher-Prigat (n 169), 763.

24 Communications Law Vol. 23, No. 1, 2018 24 Communications Law Vol. 23, No. 1, 2018 Are children more than ‘clickbait’ in the 21st century? Are children more than ‘clickbait’ in the 21st century?

Are children more than ‘clickbait’ Are children more than ‘clickbait’ in the 21st century? in the 21st century?

Baroness Beeban Kidron Baroness Beeban Kidron

This article considers the rights and privileges of child- Although we take the view that parents and those This article considers the rights and privileges of child- Although we take the view that parents and those hood, and about how we might start to redress the with parental responsibility for children offer the hood, and about how we might start to redress the with parental responsibility for children offer the imbalance of power between tech and children in first line of both care for and defence of children, imbalance of power between tech and children in first line of both care for and defence of children, the digital environment. It begins with the concept of we have also concluded that children by virtue of the digital environment. It begins with the concept of we have also concluded that children by virtue of childhood. their age, and the vulnerabilities associated with that childhood. their age, and the vulnerabilities associated with that age, require a broader set of inputs, privileges and age, require a broader set of inputs, privileges and Childhood is the word we use to describe the journey protections beyond that offered by their immediate Childhood is the word we use to describe the journey protections beyond that offered by their immediate from dependence to autonomy, from infancy to families. These inputs include a complex but widely from dependence to autonomy, from infancy to families. These inputs include a complex but widely maturity. Whilst different individual children – and understood – and respected – set of social norms, maturity. Whilst different individual children – and understood – and respected – set of social norms, different personal, social and economic circumstances educational frameworks, advisory bodies, regulatory different personal, social and economic circumstances educational frameworks, advisory bodies, regulatory – impact hugely on that journey, we have, over time, interventions, and national and international laws. – impact hugely on that journey, we have, over time, interventions, and national and international laws. established an understanding of this transition in terms established an understanding of this transition in terms of childhood norms and childhood needs, that acade- Perhaps the most recognised expression of our of childhood norms and childhood needs, that acade- Perhaps the most recognised expression of our mics call ‘childhood development milestones’. common understanding of the rights and privileges mics call ‘childhood development milestones’. common understanding of the rights and privileges of childhood is the UN Charter on the Rights of the of childhood is the UN Charter on the Rights of the A development milestone is an age, or more Child (UNCRC). It is the most ratified treaty in the A development milestone is an age, or more Child (UNCRC). It is the most ratified treaty in the commonly, an age range, by which certain maturi- world, with 196 signatories. A glaring exception is commonly, an age range, by which certain maturi- world, with 196 signatories. A glaring exception is ties and understandings are likely to be achieved the country host to the major tech companies, but ties and understandings are likely to be achieved the country host to the major tech companies, but – and conversely, an age or age range when certain nonetheless the UNCRC serves as a codified descrip- – and conversely, an age or age range when certain nonetheless the UNCRC serves as a codified descrip- maturities and understandings are ‘unlikely’ or ‘not tion of what we collectively believe is necessary to maturities and understandings are ‘unlikely’ or ‘not tion of what we collectively believe is necessary to supposed to be’ in place. So, whilst a child at 3-5 ensure a safe and secure environment for childhood. supposed to be’ in place. So, whilst a child at 3-5 ensure a safe and secure environment for childhood. years is beginning to understand that others feel and years is beginning to understand that others feel and experience life differently to them, they are not yet In addition to the UNCRC, we design and mitigate for experience life differently to them, they are not yet In addition to the UNCRC, we design and mitigate for able critically to evaluate that information and will childhood in multiple ways across all aspects of our able critically to evaluate that information and will childhood in multiple ways across all aspects of our take what they are told at face value. It is not until society. We educate, we consider paediatric medicine take what they are told at face value. It is not until society. We educate, we consider paediatric medicine between their 13th and 15th birthday that a child will to be a distinct specialism and require doctors to between their 13th and 15th birthday that a child will to be a distinct specialism and require doctors to develop a heightened sensitivity to risk; at that age obtain additional skills and expertise; we don’t crimi- develop a heightened sensitivity to risk; at that age obtain additional skills and expertise; we don’t crimi- some will embrace risk and others will shrink from it, nalise young children, and impose a public interest some will embrace risk and others will shrink from it, nalise young children, and impose a public interest but until then they are unlikely to anticipate or see it. test on the Crown Prosecution Service when but until then they are unlikely to anticipate or see it. test on the Crown Prosecution Service when Our understanding of the physical, neurological and Our understanding of the physical, neurological and emotional changes that take place during childhood emotional changes that take place during childhood has shaped society’s response. has shaped society’s response.

Communications Law Vol. 23, No. 1, 2018 25 Communications Law Vol. 23, No. 1, 2018 25 Are children more than ‘clickbait’ in the 21st century? Are children more than ‘clickbait’ in the 21st century?

considering prosecuting older children; we don’t It is in the DNA of Silicon Valley, as famously articu- considering prosecuting older children; we don’t It is in the DNA of Silicon Valley, as famously articu- allow adults to hold children to contractual obliga- lated by Mark Zuckerberg, to ‘move fast and break allow adults to hold children to contractual obliga- lated by Mark Zuckerberg, to ‘move fast and break tions; we put pedestrian crossings near schools; we things’ – but in this breathless journey to innovate, tions; we put pedestrian crossings near schools; we things’ – but in this breathless journey to innovate, rate films according to the developmental stages of communicate, and of course make money, the young, rate films according to the developmental stages of communicate, and of course make money, the young, childhood; children have special protections around privileged men I refer to have not properly consi- childhood; children have special protections around privileged men I refer to have not properly consi- sexual activity; and we make it illegal for children dered that some of the things they might break are sexual activity; and we make it illegal for children dered that some of the things they might break are to smoke, drink and gamble and even take steps to our children. In creating an environment that does not to smoke, drink and gamble and even take steps to our children. In creating an environment that does not protect them in environments where adults smoke, consider the needs of child users they have rejected protect them in environments where adults smoke, consider the needs of child users they have rejected drink and gamble. hugely precious cultural, social and legal norms of drink and gamble. hugely precious cultural, social and legal norms of childhood. childhood. In short, the overriding understanding is that society In short, the overriding understanding is that society must, above any other consideration, act in the ‘best Perhaps at first unconsciously, but for the last 10 must, above any other consideration, act in the ‘best Perhaps at first unconsciously, but for the last 10 interests’ of a child. This reflects a global consensus years at least wittingly, they have allowed a denigra- interests’ of a child. This reflects a global consensus years at least wittingly, they have allowed a denigra- that the capacity of a child to understand and act is tion of the hard-won privileges and protections that a that the capacity of a child to understand and act is tion of the hard-won privileges and protections that a necessarily limited by vulnerabilities and immaturities century and a half of careful consideration, research necessarily limited by vulnerabilities and immaturities century and a half of careful consideration, research associated with their age. and law-making across the globe has afforded our associated with their age. and law-making across the globe has afforded our children. In doing so the status of children, and child- children. In doing so the status of children, and childhood, has been changed in the plain sight of parents, hood, has been changed in the plain sight of parents, The digital environment media, civil society and governments. The digital environment media, civil society and governments.

Yet the digital environment does not reflect this I would like to kill the myth of children as ‘digital Yet the digital environment does not reflect this I would like to kill the myth of children as ‘digital consensus. Several years ago, I interviewed a number natives’ – a term which implies that they have grown consensus. Several years ago, I interviewed a number natives’ – a term which implies that they have grown of people credited with inventing the World Wide up in some exotic land which they alone understand of people credited with inventing the World Wide up in some exotic land which they alone understand Web for a film project. Repeatedly they described the and embrace in a manner that we adults never will. Web for a film project. Repeatedly they described the and embrace in a manner that we adults never will. original vision as a democratising technology where If we accept that analysis we become foot soldiers for original vision as a democratising technology where If we accept that analysis we become foot soldiers for gatekeepers would be banished and all users would Silicon Valley’s army of lobbyists who would have us gatekeepers would be banished and all users would Silicon Valley’s army of lobbyists who would have us be treated equally. believe that the ‘kids are ahead of the game’. They be treated equally. believe that the ‘kids are ahead of the game’. They most definitely are not. most definitely are not. In the middle of an interview with Nick Negroponte, In the middle of an interview with Nick Negroponte, founder of the MIT Media Lab, I had one of those As the longitudinal study, EU Kids Online, consistently founder of the MIT Media Lab, I had one of those As the longitudinal study, EU Kids Online, consistently ‘moments’ that change how you see things. I realised shows, children remain on the lowest ladder of digital ‘moments’ that change how you see things. I realised shows, children remain on the lowest ladder of digital there was a category error, because however good opportunity because they spend the most time on a there was a category error, because however good opportunity because they spend the most time on a it first sounds, if you treat everyone equally then de few highly commercial sites and have the least critical it first sounds, if you treat everyone equally then de few highly commercial sites and have the least critical facto you treat a child as if they are an adult. And a understanding and facility to understand, organise or facto you treat a child as if they are an adult. And a understanding and facility to understand, organise or child is a child until they reach maturity – not until use the information they are presented with online. As child is a child until they reach maturity – not until use the information they are presented with online. As they reach for their smartphone. an eminent child psychologist wrote: ‘Using techno- they reach for their smartphone. an eminent child psychologist wrote: ‘Using technology with two fast thumbs cannot, in itself, be taken logy with two fast thumbs cannot, in itself, be taken Perhaps even more important than the category error as evidence that a child is a creative participant in the Perhaps even more important than the category error as evidence that a child is a creative participant in the that I identified was that other promise – to get rid digital environment with full literacy, citizenship and that I identified was that other promise – to get rid digital environment with full literacy, citizenship and of the gatekeepers. The founders’ utopian vision – a agency.’ In plain language this means that just because of the gatekeepers. The founders’ utopian vision – a agency.’ In plain language this means that just because network of open-source small holders with a chain of you can access technology, it doesn’t mean that you network of open-source small holders with a chain of you can access technology, it doesn’t mean that you active participant users – had been rapidly replaced understand or control it! active participant users – had been rapidly replaced understand or control it! by a handful of powerful platforms that quickly by a handful of powerful platforms that quickly made the digital environment more powerful, less I would particularly like to draw attention to the made the digital environment more powerful, less I would particularly like to draw attention to the responsive, more autocratic and less accountable concept of ‘agency’ to which the psychologist refers. responsive, more autocratic and less accountable concept of ‘agency’ to which the psychologist refers. than the gatekeepers they had promised to replace. A child that has ‘agency’ has the ability to make than the gatekeepers they had promised to replace. A child that has ‘agency’ has the ability to make It made a handful of young, privileged men (mainly choices based on information that has been provided It made a handful of young, privileged men (mainly choices based on information that has been provided young, mainly privileged, and mainly men) insanely in a way they can understand, and in conditions in young, mainly privileged, and mainly men) insanely in a way they can understand, and in conditions in rich and insanely powerful on a global scale, with no which that choice is meaningful. rich and insanely powerful on a global scale, with no which that choice is meaningful. balancing oversight or societal responsibilities. This balancing oversight or societal responsibilities. This is something that governments, international institu- With that in mind I would like to repeat a conversa- is something that governments, international institu- With that in mind I would like to repeat a conversa- tions, and several increasingly unhappy ‘inventors and tion I had recently with the Managing Director of IT tions, and several increasingly unhappy ‘inventors and tion I had recently with the Managing Director of IT founders’ are only now beginning to understand. at a major technology company, who described the founders’ are only now beginning to understand. at a major technology company, who described the ‘bundle’ of technological methods currently used ‘bundle’ of technological methods currently used to capture and hold our attention on the tubing, to capture and hold our attention on the tubing, gaming and social media platforms where children gaming and social media platforms where children

26 Communications Law Vol. 23, No. 1, 2018 26 Communications Law Vol. 23, No. 1, 2018 Are children more than ‘clickbait’ in the 21st century? Are children more than ‘clickbait’ in the 21st century? spend so much of their time. This bundle is referred Children’s developmental spend so much of their time. This bundle is referred Children’s developmental to as captology. It is its own science; the science of capacity to as captology. It is its own science; the science of capacity capturing a person’s attention and keeping them in capturing a person’s attention and keeping them in ‘rapture’, which can include: A child, not yet fully-formed, does not have the ‘rapture’, which can include: A child, not yet fully-formed, does not have the developmental capacity to resist one or another or a developmental capacity to resist one or another or a Q soft rhythmic sounds or music to block out real life; combination of these pulls. The algorithms follow their Q soft rhythmic sounds or music to block out real life; combination of these pulls. The algorithms follow their behaviour on such tight loops that they can, in real behaviour on such tight loops that they can, in real Q sharp, narrative sounds to pull user attention to time, provide the ‘exact’ personalised mix to keep Q sharp, narrative sounds to pull user attention to time, provide the ‘exact’ personalised mix to keep what is happening on screen; them clicking. So, if one child is more responsive what is happening on screen; them clicking. So, if one child is more responsive to image and confirmation from peers but another to image and confirmation from peers but another Q bright, intense light that vibrates intermittently at responds to sharp sounds and being set challenges, Q bright, intense light that vibrates intermittently at responds to sharp sounds and being set challenges, high speed; each will get the loop of events that will most entice high speed; each will get the loop of events that will most entice them to their own ‘personalised’ state of rapture. them to their own ‘personalised’ state of rapture. Q cycles of intense activity followed by a slow end – Q cycles of intense activity followed by a slow end – like changing an avatar, or responding to a message, These techniques are digital norms that I’m sure we like changing an avatar, or responding to a message, These techniques are digital norms that I’m sure we or being congratulated – only to be interrupted by all recognise from our own experience, but they are or being congratulated – only to be interrupted by all recognise from our own experience, but they are something fast and even more intense to drag the especially potent when deployed against children something fast and even more intense to drag the especially potent when deployed against children user back just as they are ready to quit (this, she whose brains are still being moulded, and whose user back just as they are ready to quit (this, she whose brains are still being moulded, and whose explained, is because if you think you are getting critical thinking has yet to mature. Most importantly, explained, is because if you think you are getting critical thinking has yet to mature. Most importantly, off, but come back at the last minute, you will stay they deliberately orchestrate a context in which a off, but come back at the last minute, you will stay they deliberately orchestrate a context in which a longer than if you are attached for a single exhaus- child cannot make a meaningful choice whether or longer than if you are attached for a single exhaus- child cannot make a meaningful choice whether or ting session at the same pace); not to engage with their digital environment – ie to ting session at the same pace); not to engage with their digital environment – ie to exercise their right to agency. They are in the digital exercise their right to agency. They are in the digital Q vibrating devices; sweetshop, which most certainly has its pleasures and Q vibrating devices; sweetshop, which most certainly has its pleasures and positive outcomes, but it does not provide a balanced positive outcomes, but it does not provide a balanced Q confirmation signals from peers – the heart/like/ diet. Being stuck there in a state of ‘rapture’ is not in Q confirmation signals from peers – the heart/like/ diet. Being stuck there in a state of ‘rapture’ is not in share buttons; the ‘best interests’ of the child. share buttons; the ‘best interests’ of the child.

Q random confirmations – from algorithms that feel Research carried out in the US by Common Sense Q random confirmations – from algorithms that feel Research carried out in the US by Common Sense your waning activity; Media in 2016 found that 70 per cent of teenagers your waning activity; Media in 2016 found that 70 per cent of teenagers argued with their parents about their devices, with 32 argued with their parents about their devices, with 32 Q personal streaks – not breaking a ‘run’ irrespective per cent saying devices caused arguments on a daily Q personal streaks – not breaking a ‘run’ irrespective per cent saying devices caused arguments on a daily of any intrinsic value in the exchange; basis.1 Research conducted across different childhood of any intrinsic value in the exchange; basis.1 Research conducted across different childhood age groups and multiple locations reflected a similar age groups and multiple locations reflected a similar Q community streaks – not breaking a ‘run’ with pattern, and in 2017 tech-related conflict was widely Q community streaks – not breaking a ‘run’ with pattern, and in 2017 tech-related conflict was widely someone else so that you are not guilty or embar- reported as the top cause of familial discord in the someone else so that you are not guilty or embar- reported as the top cause of familial discord in the rassed, irrespective of your desire to be in contact UK. rassed, irrespective of your desire to be in contact UK. with that person; with that person; I have spent my whole life working in media, and I have spent my whole life working in media, and Q attracting your attention with a key word or image have set up organisations that encourage young Q attracting your attention with a key word or image have set up organisations that encourage young that you have just used in another setting; people to watch films online. I regularly co-create that you have just used in another setting; people to watch films online. I regularly co-create technology with children, and I am a strong advocate technology with children, and I am a strong advocate Q attracting your attention with an extreme word or for the rights of children to access the digital environ- Q attracting your attention with an extreme word or for the rights of children to access the digital environ- powerful image; ment. But I see an increasing tension between a powerful image; ment. But I see an increasing tension between a technology that has a singular power to redress some technology that has a singular power to redress some Q attracting your attention by showing you that others of the world’s greatest challenges and inequities, Q attracting your attention by showing you that others of the world’s greatest challenges and inequities, in your circle are online, getting more attention, and a corporate culture that aggressively rejects its in your circle are online, getting more attention, and a corporate culture that aggressively rejects its posting more, etc; societal responsibilities to the communities in which posting more, etc; societal responsibilities to the communities in which it operates and to the people which it so successfully it operates and to the people which it so successfully Q the colour blue. commoditises. Q the colour blue. commoditises.

And this list, though exhausting, is not exhaustive! I am not alone. Jaron Lanier, inventor of virtual And this list, though exhausting, is not exhaustive! I am not alone. Jaron Lanier, inventor of virtual reality; Sean Parker, the co-founder of Facebook; reality; Sean Parker, the co-founder of Facebook; Sir Tim Berners-Lee, inventor of the web; and Justin Sir Tim Berners-Lee, inventor of the web; and Justin Rosenstein, the designer of Facebook’s ‘Like’ button, Rosenstein, the designer of Facebook’s ‘Like’ button, have in various recent public pronouncements have in various recent public pronouncements

Communications Law Vol. 23, No. 1, 2018 27 Communications Law Vol. 23, No. 1, 2018 27 Are children more than ‘clickbait’ in the 21st century? Are children more than ‘clickbait’ in the 21st century?

decried the problematic use of technology against its the experience sleepless, anxious, and overexposed. decried the problematic use of technology against its the experience sleepless, anxious, and overexposed. users. Jaron Lanier accused tech of having gone over It cannot be a good use of technology to allow its users. Jaron Lanier accused tech of having gone over It cannot be a good use of technology to allow its a threshold into behaviourist scientific experiments brightest and finest to ignore the needs of most vulne- a threshold into behaviourist scientific experiments brightest and finest to ignore the needs of most vulne- in which behaviour is provoked by stimuli that can rable demographic in our society, and it is a failure for in which behaviour is provoked by stimuli that can rable demographic in our society, and it is a failure for guarantee changed human behaviours, and that the any government, international institution or legislative guarantee changed human behaviours, and that the any government, international institution or legislative wellbeing of the nation (by which he meant America) body not to do what it can to tackle these norms. wellbeing of the nation (by which he meant America) body not to do what it can to tackle these norms. depends on stopping it. He called for a new culture, depends on stopping it. He called for a new culture, in which users have ‘dignity and autonomy’. I want to make it clear that the answer is not to kick in which users have ‘dignity and autonomy’. I want to make it clear that the answer is not to kick children out of the digital environment – on the children out of the digital environment – on the I believe that not just the wellbeing of America is at contrary, every child should be allowed to access the I believe that not just the wellbeing of America is at contrary, every child should be allowed to access the stake, but the wellbeing of children the world over. digital environment creatively, knowledgeably and stake, but the wellbeing of children the world over. digital environment creatively, knowledgeably and Whether a child loves cartoons, football, fashion, fearlessly. But the digital environment is a network of Whether a child loves cartoons, football, fashion, fearlessly. But the digital environment is a network of music or comedy, or whether they are a gamer, a businesses that provides services to children, and those music or comedy, or whether they are a gamer, a businesses that provides services to children, and those tuber or a social media junkie or simply interested in businesses need to be responsive to their presence. It tuber or a social media junkie or simply interested in businesses need to be responsive to their presence. It the news, online services will deploy the full power was that simple principle that led me to found 5Rights the news, online services will deploy the full power was that simple principle that led me to found 5Rights of their data-churning algorithms to ensure that a to, in effect, deliver the rights of the UN Charter in of their data-churning algorithms to ensure that a to, in effect, deliver the rights of the UN Charter in child is perpetually bombarded with a bespoke recipe online settings. child is perpetually bombarded with a bespoke recipe online settings. of emotional and technological pulls. Designed by of emotional and technological pulls. Designed by engineers, delivered by robots, in an environment engineers, delivered by robots, in an environment where neither the engineers nor the robots have any The rights and needs of minors where neither the engineers nor the robots have any The rights and needs of minors responsibility for the consequences, these ‘bespoke’, responsibility for the consequences, these ‘bespoke’, or should I say ‘personalised’, recipes are designed to Over the last several years 5Rights has made many or should I say ‘personalised’, recipes are designed to Over the last several years 5Rights has made many keep a child clicking for as long as possible. interventions and worked with many organisations, keep a child clicking for as long as possible. interventions and worked with many organisations, nationally and internationally. Our mission is to nationally and internationally. Our mission is to The consequences of this were highlighted recently take every opportunity on all platforms supporting The consequences of this were highlighted recently take every opportunity on all platforms supporting when it was revealed that machine-learning algorithms research, policy and the building of tech in order to when it was revealed that machine-learning algorithms research, policy and the building of tech in order to that generate content for YouTube Kids, which are make the case that although 21st century children that generate content for YouTube Kids, which are make the case that although 21st century children based on popular trends and key word searches, always need access to the digital world, they need based on popular trends and key word searches, always need access to the digital world, they need resulted in thousands of deeply creepy, sometimes it on new and improved terms. Those terms must resulted in thousands of deeply creepy, sometimes it on new and improved terms. Those terms must violent, videos being watched by hundreds of include their right to change their digital footprint violent, videos being watched by hundreds of include their right to change their digital footprint thousands of very young children. These videos do and identity; to be safe and supported in online thousands of very young children. These videos do and identity; to be safe and supported in online not reflect the social norms of childhood, yet no one settings; to understand who, how and what their data not reflect the social norms of childhood, yet no one settings; to understand who, how and what their data stepped in to temper the consequences of algorithms is being used for; to be informed and creative partici- stepped in to temper the consequences of algorithms is being used for; to be informed and creative partici- deciding what our children watch. When YouTube pant digital citizens; and above all, to have ‘agency’ deciding what our children watch. When YouTube pant digital citizens; and above all, to have ‘agency’ finally responded, they announced they would restrict – meaningful choice in an environment that is finally responded, they announced they would restrict – meaningful choice in an environment that is these videos once reported. This is a solution that relies responsive to, and respectful of, their full complement these videos once reported. This is a solution that relies responsive to, and respectful of, their full complement on pre-schoolers policing content. Where children are of rights and needs as minors. on pre-schoolers policing content. Where children are of rights and needs as minors. the end user, surely we need better oversight than that? the end user, surely we need better oversight than that? I hope I have made my case that we have a problem. I hope I have made my case that we have a problem. Children year on year spend more and more time So, what is to be done about it? Self-regulation is a Children year on year spend more and more time So, what is to be done about it? Self-regulation is a online – for a 12-15 year old in the UK it was 20 plus whole topic in itself, so here is my brief ABC: online – for a 12-15 year old in the UK it was 20 plus whole topic in itself, so here is my brief ABC: hours a week in 2016. But I share the opinion of hours a week in 2016. But I share the opinion of Professor Sonia Livingstone that it is inadequate to look A. Silicon Valley is not very interested in children. Professor Sonia Livingstone that it is inadequate to look A. Silicon Valley is not very interested in children. at how long children are online. What we should be The real interest is in drones and driverless cars, at how long children are online. What we should be The real interest is in drones and driverless cars, looking at is what they are doing online and what being conquering space and cryogenics, and opera- looking at is what they are doing online and what being conquering space and cryogenics, and opera- online is doing to them. Being online is not in, and of tional leverage – specifically how robots can online is doing to them. Being online is not in, and of tional leverage – specifically how robots can itself, bad, risky, unhealthy or negative in any other way. replace humans to provide a high gross margin, itself, bad, risky, unhealthy or negative in any other way. replace humans to provide a high gross margin, and naturally share price. The one third of all users and naturally share price. The one third of all users However, commercial environments that are largely that are children are an inconvenient truth for big However, commercial environments that are largely that are children are an inconvenient truth for big designed for adults, and demand significant levels tech, beautifully illustrated by the fact that they designed for adults, and demand significant levels tech, beautifully illustrated by the fact that they of interaction and normalise the spread of personal consistently refuse to collect and publish data on of interaction and normalise the spread of personal consistently refuse to collect and publish data on information, are not great environments for children children’s complaints or monitor under-age use of information, are not great environments for children children’s complaints or monitor under-age use of to spend the bulk of their time. These young people their services. to spend the bulk of their time. These young people their services. are entering contracts and giving away vast swathes are entering contracts and giving away vast swathes of personal information, using services that do not of personal information, using services that do not take account of their age. They are emerging from take account of their age. They are emerging from

28 Communications Law Vol. 23, No. 1, 2018 28 Communications Law Vol. 23, No. 1, 2018 Are children more than ‘clickbait’ in the 21st century? Are children more than ‘clickbait’ in the 21st century?

B. There is both an explicit and implicit message from Taking regulatory action B. There is both an explicit and implicit message from Taking regulatory action industry that we have to make children ‘resilient’ industry that we have to make children ‘resilient’ and inform them of risk. Some businesses are doing In Germany, a new law was introduced in 2017 that and inform them of risk. Some businesses are doing In Germany, a new law was introduced in 2017 that excellent work in both these areas, but there is a places an obligation on online services to remove excellent work in both these areas, but there is a places an obligation on online services to remove great deal less appetite to design their services to obviously illegal hate speech within 24 hours, or face great deal less appetite to design their services to obviously illegal hate speech within 24 hours, or face make them fit for children. I see no world order in fines of up to €50 million. Cities all over the world make them fit for children. I see no world order in fines of up to €50 million. Cities all over the world which the duty should rest on a child to adapt to have responded to digital services, such AirBnB which the duty should rest on a child to adapt to have responded to digital services, such AirBnB the needs of tech, rather than on tech to adapt to and Uber, in a way that reflects local concerns and the needs of tech, rather than on tech to adapt to and Uber, in a way that reflects local concerns and the needs of childhood. existing regulatory frameworks. The extensive provi- the needs of childhood. existing regulatory frameworks. The extensive provisions for Member State derogations in the GDPR sions for Member State derogations in the GDPR C. Whenever we talk codes or conditions there is a anticipates not just the feasibility of, but the need for, C. Whenever we talk codes or conditions there is a anticipates not just the feasibility of, but the need for, unified response – that any form of conditionality bespoke, national solutions. The GDPR, imperfect unified response – that any form of conditionality bespoke, national solutions. The GDPR, imperfect would mean tech have to turn its back on young as it is, provides proof that principles-based regula- would mean tech have to turn its back on young as it is, provides proof that principles-based regula- people, thereby throwing them off their platforms tion, instigated in this case by the EU, can act as a people, thereby throwing them off their platforms tion, instigated in this case by the EU, can act as a and services. The response is based on the premise global catalyst as companies roll the standards out and services. The response is based on the premise global catalyst as companies roll the standards out that the natural choice is between children using worldwide. that the natural choice is between children using worldwide. adult services or nothing. This is, at best, diversio- adult services or nothing. This is, at best, diversio- nary; nearly a billion current users are children, so The IT lead of one of the biggest pharmaceutical nary; nearly a billion current users are children, so The IT lead of one of the biggest pharmaceutical should they be cast out then undoubtedly someone companies in the word recently said to me, and should they be cast out then undoubtedly someone companies in the word recently said to me, and else will see the competitive advantage in develo- I paraphrase: ‘Whilst the rules of the GDPR are else will see the competitive advantage in develo- I paraphrase: ‘Whilst the rules of the GDPR are ping services for them. But more insidious is Silicon perhaps a little opaque its intention is clear. So, we ping services for them. But more insidious is Silicon perhaps a little opaque its intention is clear. So, we Valley’s corporate attitude to young people. It does are working to the intention – because that is the right Valley’s corporate attitude to young people. It does are working to the intention – because that is the right seem that self-regulation is little more than leaving thing to do’. I, with the support of colleagues right seem that self-regulation is little more than leaving thing to do’. I, with the support of colleagues right the fox in charge of the henhouse. across the political divide, tabled a set of amend- the fox in charge of the henhouse. across the political divide, tabled a set of amendments to the Data Protection Bill that established an ments to the Data Protection Bill that established an And just to be an unreliable commentator, my ABC ‘age-appropriate design code’ as a requirement for And just to be an unreliable commentator, my ABC ‘age-appropriate design code’ as a requirement for has a D. This is no longer a new environment. At 27 processing the data of children under 18. has a D. This is no longer a new environment. At 27 processing the data of children under 18. years old, it is, unlike many of its users, fully adult and years old, it is, unlike many of its users, fully adult and grown. Much like all the information technologies, The amendments, set out in detail in Hansard 2, repre- grown. Much like all the information technologies, The amendments, set out in detail in Hansard 2, repre- all the industrial sectors, and all the global companies sent a step towards a better digital future for children all the industrial sectors, and all the global companies sent a step towards a better digital future for children before them, tech is ready to take on and live up to its by: before them, tech is ready to take on and live up to its by: adult responsibilities. If you earn and own more than adult responsibilities. If you earn and own more than most nation states, your responsibilities – and alloca- Q crucially, connecting design of services with the most nation states, your responsibilities – and alloca- Q crucially, connecting design of services with the ting the resources to meet them – are self-evident. development needs of children – recognising that ting the resources to meet them – are self-evident. development needs of children – recognising that Equally self-evident is that year on year kids are childhood is a graduated journey from dependence Equally self-evident is that year on year kids are childhood is a graduated journey from dependence having a harder and harder time online. to autonomy; having a harder and harder time online. to autonomy;

It really is time to bring this brave new world of tech Q introducing a code that will set out the standards by It really is time to bring this brave new world of tech Q introducing a code that will set out the standards by into the real world of the 21st century, where every which online services protect children’s data; into the real world of the 21st century, where every which online services protect children’s data; other business corporation, state and civil society other business corporation, state and civil society actor – and indeed every human on the planet – lives, Q setting standards that are directly related to a child’s actor – and indeed every human on the planet – lives, Q setting standards that are directly related to a child’s or fails to live, by a set of agreed standards upheld by age and the vulnerabilities associated with that age; or fails to live, by a set of agreed standards upheld by age and the vulnerabilities associated with that age; regulation. What is needed is a global agreement that regulation. What is needed is a global agreement that has at its heart some key provisions about the rights Q clarifying the expectation on services to design data has at its heart some key provisions about the rights Q clarifying the expectation on services to design data of users. Like others who take a close interest in this practices that put the ‘best interests’ of the child of users. Like others who take a close interest in this practices that put the ‘best interests’ of the child subject, I see a future where we will all be individual above any other consideration, including their own subject, I see a future where we will all be individual above any other consideration, including their own data providers, and commercial companies and other commercial interests; data providers, and commercial companies and other commercial interests; organisations will access us on terms and conditions organisations will access us on terms and conditions that we set to reflect our limits, our tolerances and Q establishing the standards by which the Information that we set to reflect our limits, our tolerances and Q establishing the standards by which the Information our interests. But returning to the present, it is impor- Commissioner will judge services on behalf of child our interests. But returning to the present, it is impor- Commissioner will judge services on behalf of child tant to dispel the double-myth inherent in the digital users. tant to dispel the double-myth inherent in the digital users. environment that it cannot reflect jurisdictions, and environment that it cannot reflect jurisdictions, and that it cannot be regulated. We have seen a number Subsequent amendments deal with creating guidance that it cannot be regulated. We have seen a number Subsequent amendments deal with creating guidance of push backs on several fronts and in many sectors. on age-appropriate design and Parliamentary of push backs on several fronts and in many sectors. on age-appropriate design and Parliamentary oversight. One small set of amendments to a data Bill oversight. One small set of amendments to a data Bill in one country, on one specific part of a child’s digital in one country, on one specific part of a child’s digital

Communications Law Vol. 23, No. 1, 2018 29 Communications Law Vol. 23, No. 1, 2018 29 Are children more than ‘clickbait’ in the 21st century? Are children more than ‘clickbait’ in the 21st century?

life, is not a complete solution – but these amend- visible to and understood by a minor; and insisting on life, is not a complete solution – but these amend- visible to and understood by a minor; and insisting on ments achieve a few key things in that they: reporting processes with an end-point and a reaso- ments achieve a few key things in that they: reporting processes with an end-point and a reasonable expectation of resolution. nable expectation of resolution. Q separate a child’s data from that of an adult; Q separate a child’s data from that of an adult; None of the regulatory measures referred to above None of the regulatory measures referred to above Q build on the industry norms of personalisation, and are beyond technology. They are not overbearing, Q build on the industry norms of personalisation, and are beyond technology. They are not overbearing, take existing technology and set it to work for the do not hold back innovation, and do not discrimi- take existing technology and set it to work for the do not hold back innovation, and do not discrimi- child user (as one boy said to me, ‘how come if nate between one set of data processors and another. child user (as one boy said to me, ‘how come if nate between one set of data processors and another. they know I like red Nikes they don’t know I am They will, like the GDPR or accessible design, they know I like red Nikes they don’t know I am They will, like the GDPR or accessible design, 12?’); simply become industry standards – a price of doing 12?’); simply become industry standards – a price of doing business. business. Q meet the United Kingdom’s current obligation to Q meet the United Kingdom’s current obligation to ensure that our national legislation is compatible No system will ever protect all children at all times ensure that our national legislation is compatible No system will ever protect all children at all times with the GDPR, and safeguard our prospects of from risks and transgressions – accidental or inten- with the GDPR, and safeguard our prospects of from risks and transgressions – accidental or inten- securing an adequacy agreement post-Brexit; tional. But to start by acknowledging their special securing an adequacy agreement post-Brexit; tional. But to start by acknowledging their special status as children in an environment – that is the status as children in an environment – that is the Q enshrine the long-held view that the first duty of environment in which their childhood plays out – Q enshrine the long-held view that the first duty of environment in which their childhood plays out – any government is to protect its citizens – and most can only be a good thing. In an industry dominated any government is to protect its citizens – and most can only be a good thing. In an industry dominated importantly, those who are too vulnerable to protect by data, children’s data needs its own special importantly, those who are too vulnerable to protect by data, children’s data needs its own special themselves – and fulfil our duty of care to children. consideration. themselves – and fulfil our duty of care to children. consideration.

Detailed guidelines are necessary in the future, The world has just short of a billion children online. Detailed guidelines are necessary in the future, The world has just short of a billion children online. but what the amendment I put forward asks the They have a right to be more than clickbait toiling but what the amendment I put forward asks the They have a right to be more than clickbait toiling Information Commissioner to take into account are in the fields of Silicon Valley. It is up to all of us to Information Commissioner to take into account are in the fields of Silicon Valley. It is up to all of us to such matters as a child’s need for high privacy settings advocate for this right and to fulfil the founders’ vision such matters as a child’s need for high privacy settings advocate for this right and to fulfil the founders’ vision by default; not revealing their GPS location; using of a better digital world. by default; not revealing their GPS location; using of a better digital world. their data only to enable them to use a service as they their data only to enable them to use a service as they wish and no more; and not automatically excluding Baroness Beeban Kidron wish and no more; and not automatically excluding Baroness Beeban Kidron children if they will not give up vast swathes of data – The author is an award-winning film director, children if they will not give up vast swathes of data – The author is an award-winning film director, however nicely they are asked. Crossbench member of the House of Lords, and a however nicely they are asked. Crossbench member of the House of Lords, and a member of the House of Lords Communications member of the House of Lords Communications If the Commissioner so wished, guidelines could Committee. She sits on the UN Broadband If the Commissioner so wished, guidelines could Committee. She sits on the UN Broadband also extend to giving a child time off by not sending Commission for Sustainable Development and the also extend to giving a child time off by not sending Commission for Sustainable Development and the endless notifications during school hours or sleep Royal Foundation’s Taskforce on the Prevention endless notifications during school hours or sleep Royal Foundation’s Taskforce on the Prevention hours, and deactivating features designed to promote of Cyberbullying, and is the founder of 5Rights, a hours, and deactivating features designed to promote of Cyberbullying, and is the founder of 5Rights, a extended use; making commercially driven content, campaign which delivers the established rights of extended use; making commercially driven content, campaign which delivers the established rights of whether a vlogger or a direct marketing campaign, children in the digital environment. whether a vlogger or a direct marketing campaign, children in the digital environment.

Notes Notes

1 https://www.commonsensemedia.org/sites/default/ﬁles/uploads/ 2 Hansard, (HC) Vol 787, col 1427 (11 December 2017). 1 https://www.commonsensemedia.org/sites/default/ﬁles/uploads/ 2 Hansard, (HC) Vol 787, col 1427 (11 December 2017). research/2016_csm_technology_addiction_executive_summary.pdf research/2016_csm_technology_addiction_executive_summary.pdf

30 Communications Law Vol. 23, No. 1, 2018 30 Communications Law Vol. 23, No. 1, 2018 Interpreting the child-related provisions of the GDPR Interpreting the child-related provisions of the GDPR

Interpreting the child-related Interpreting the child-related provisions of the GDPR provisions of the GDPR

Lisa Atkinson Lisa Atkinson

My focus, both professionally and in this article, is on that children themselves were worried about. But is My focus, both professionally and in this article, is on that children themselves were worried about. But is what the General Data Protection Regulation (GDPR) that because there is nothing for them to worry about? what the General Data Protection Regulation (GDPR) that because there is nothing for them to worry about? says about children’s personal data, and the lands- Or because they haven’t yet developed the critical says about children’s personal data, and the lands- Or because they haven’t yet developed the critical cape that has led to those provisions. In 2015 the reasoning abilities to know they need to worry? It is in cape that has led to those provisions. In 2015 the reasoning abilities to know they need to worry? It is in Global Privacy Enforcement Network, made up of this kind of context that the text of the General Data Global Privacy Enforcement Network, made up of this kind of context that the text of the General Data data protection authorities from around the world, Protection Regulation was debated and agreed. data protection authorities from around the world, Protection Regulation was debated and agreed. did a sweep of websites and apps that were targeted did a sweep of websites and apps that were targeted at, or popular with, children. Sweepers indicated that Recital 38 to the GDPR sets the overall tone for the at, or popular with, children. Sweepers indicated that Recital 38 to the GDPR sets the overall tone for the they would be uncomfortable with children using 41 treatment of children’s personal data when it says they would be uncomfortable with children using 41 treatment of children’s personal data when it says per cent of the websites reviewed. Their concerns that: ‘Children merit specific protection with regard to per cent of the websites reviewed. Their concerns that: ‘Children merit specific protection with regard to included: their personal data, as they may be less aware of the included: their personal data, as they may be less aware of the risks, consequences and safeguards concerned and risks, consequences and safeguards concerned and Q the over-collection of personal data; their rights in relation to the processing of personal Q the over-collection of personal data; their rights in relation to the processing of personal data.’ It calls for particular care in the contexts of data.’ It calls for particular care in the contexts of Q failure to use language that children could marketing and profiling, and when offering online Q failure to use language that children could marketing and profiling, and when offering online understand; services. understand; services.

Q disclosure of information to third parties for vague One of the provisions which have caused the most Q disclosure of information to third parties for vague One of the provisions which have caused the most or unspecified reasons; and debate and consternation is the online consent requi- or unspecified reasons; and debate and consternation is the online consent requirement. Article 8 of the GDPR says that when consent rement. Article 8 of the GDPR says that when consent Q the facility for children to overshare personal data is relied upon as the basis for processing personal Q the facility for children to overshare personal data is relied upon as the basis for processing personal through unmonitored chat rooms. data, only children over a certain age (to be decided through unmonitored chat rooms. data, only children over a certain age (to be decided at national level) will be able to provide their own at national level) will be able to provide their own On the positive side, they also commented that: ‘One consent. For anyone under that age of digital consent, On the positive side, they also commented that: ‘One consent. For anyone under that age of digital consent, third of websites or apps that were swept demons- consent from a holder of parental responsibility will third of websites or apps that were swept demons- consent from a holder of parental responsibility will trated that they could be successful, appealing and have to be sought and verified. trated that they could be successful, appealing and have to be sought and verified. dynamic without the need to collect any personal dynamic without the need to collect any personal information at all.’ The UK has provisionally set this age at 13, though information at all.’ The UK has provisionally set this age at 13, though the Parliamentary debate about this continues. It the Parliamentary debate about this continues. It Interestingly, a 2013 report1 which raised concerns should be emphasised that article 8 is not a revolu- Interestingly, a 2013 report1 which raised concerns should be emphasised that article 8 is not a revolu- about the misuse of children’s personal information tionary new requirement. Under the Data Protection about the misuse of children’s personal information tionary new requirement. Under the Data Protection accounted for less than 3 per cent of the online risks Act (DPA), data controllers who rely upon consent accounted for less than 3 per cent of the online risks Act (DPA), data controllers who rely upon consent

Communications Law Vol. 23, No. 1, 2018 31 Communications Law Vol. 23, No. 1, 2018 31 Interpreting the child-related provisions of the GDPR Interpreting the child-related provisions of the GDPR

are already required to make sure that that consent processing is addressed to a child, should be in such are already required to make sure that that consent processing is addressed to a child, should be in such is ‘freely given, specific and informed’ [my emphasis]. a clear and plain language that the child can easily is ‘freely given, specific and informed’ [my emphasis]. a clear and plain language that the child can easily The existing ‘Guide to data protection’ produced by understand’. Again, the ICO considers that this brings The existing ‘Guide to data protection’ produced by understand’. Again, the ICO considers that this brings the Information Commissioner’s Office (ICO) is clear into focus existing advice in our Privacy Notices the Information Commissioner’s Office (ICO) is clear into focus existing advice in our Privacy Notices this means that consent must already be ‘appropriate Code of Practices. For example, we already say that this means that consent must already be ‘appropriate Code of Practices. For example, we already say that to the age and capacity of the individual and to the data controllers need to draft privacy notices that to the age and capacity of the individual and to the data controllers need to draft privacy notices that particular circumstances of the case.’ are appropriate to the level of understanding of the particular circumstances of the case.’ are appropriate to the level of understanding of the audience being addressed and not exploit any lack audience being addressed and not exploit any lack The ‘new challenges’ of article 8, are, in the ICO’s of understanding. We already recommend the use The ‘new challenges’ of article 8, are, in the ICO’s of understanding. We already recommend the use view, just existing challenges that have been brought of methods such as ‘just in time notices’, ICONS and view, just existing challenges that have been brought of methods such as ‘just in time notices’, ICONS and into sharper focus by the GDPR. What article 8 seeks clear preference settings. into sharper focus by the GDPR. What article 8 seeks clear preference settings. to do is to give providers of online services to children to do is to give providers of online services to children some certainty in what is an existing grey area by The GDPR also brings in new provisions about profi- some certainty in what is an existing grey area by The GDPR also brings in new provisions about profi- providing a set age at which they can assume that ling and automated decision-making, and there has providing a set age at which they can assume that ling and automated decision-making, and there has children are competent to provide their own consent. been some debate about whether recital 38 amounts children are competent to provide their own consent. been some debate about whether recital 38 amounts to a complete prohibition on automated decision- to a complete prohibition on automated decision- The GDPR also brings the requirement to have a making based on the processing of children’s personal The GDPR also brings the requirement to have a making based on the processing of children’s personal lawful basis for processing ‘up front and central’. data. The Article 29 Working Party has clarified that lawful basis for processing ‘up front and central’. data. The Article 29 Working Party has clarified that Conditions for processing have always been a requi- this is not the case in its recently published opinion Conditions for processing have always been a requi- this is not the case in its recently published opinion rement under the DPA, but the GDPR states that on profiling, but the ICO believes great care is still rement under the DPA, but the GDPR states that on profiling, but the ICO believes great care is still controllers have to tell data subjects the lawful basis needed in this area and controllers will really need to controllers have to tell data subjects the lawful basis needed in this area and controllers will really need to they are relying upon in their privacy notice before be able to justify what they are doing in this context, they are relying upon in their privacy notice before be able to justify what they are doing in this context, they start the processing. and in the context of marketing. they start the processing. and in the context of marketing.

This ties in neatly to the additional focus on Data Finally, the right to erasure provision gives particular This ties in neatly to the additional focus on Data Finally, the right to erasure provision gives particular Protection Impact Assessments, which the ICO regards recognition to the rights of data subjects who gave Protection Impact Assessments, which the ICO regards recognition to the rights of data subjects who gave as a vital tool in helping controllers to assess the risks their consent to processing as children, and now wish as a vital tool in helping controllers to assess the risks their consent to processing as children, and now wish of the processing of children’s personal data, mitigate to have their data erased. of the processing of children’s personal data, mitigate to have their data erased. these risks, and ultimately, decide whether the proces- these risks, and ultimately, decide whether the processing can be justified and if so under which lawful To sum up, the ICO welcomes the new focus on sing can be justified and if so under which lawful To sum up, the ICO welcomes the new focus on basis. This is one of the ICO’s key messages in relation children’s privacy that the GDPR brings to data basis. This is one of the ICO’s key messages in relation children’s privacy that the GDPR brings to data to children’s personal data. Controllers need to think controllers and to our own work and priorities. It is an to children’s personal data. Controllers need to think controllers and to our own work and priorities. It is an about the children up front, when they are designing opportunity to reflect and recalibrate. This can only about the children up front, when they are designing opportunity to reflect and recalibrate. This can only the processing, to make sure that they give them the be a good thing, and we await further developments the processing, to make sure that they give them the be a good thing, and we await further developments specific protection they merit. Controllers also need and debate with interest specific protection they merit. Controllers also need and debate with interest to be clear what data is being processed under which to be clear what data is being processed under which lawful basis. Lisa Atkinson lawful basis. Lisa Atkinson The author is a Group Manager in the Policy The author is a Group Manager in the Policy There are also more comprehensive transparency and Engagement Department of the Information There are also more comprehensive transparency and Engagement Department of the Information requirements in the GDPR. For children these requi- Commissioner’s Office. She is leading the ICO’s requirements in the GDPR. For children these requi- Commissioner’s Office. She is leading the ICO’s rements are clarified by the recital 58 statement that work on interpreting the child-related provisions of rements are clarified by the recital 58 statement that work on interpreting the child-related provisions of says ‘any information and communication, where the GDPR. says ‘any information and communication, where the GDPR.

Notes Notes

1 In their own words – what bothers kids online, report of a survey 1 In their own words – what bothers kids online, report of a survey by EU Kids Online. by EU Kids Online.

32 Communications Law Vol. 23, No. 1, 2018 32 Communications Law Vol. 23, No. 1, 2018 The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR

The importance of privacy by The importance of privacy by design and data protection impact design and data protection impact assessments in strengthening assessments in strengthening protection of children’s personal protection of children’s personal data under the GDPR data under the GDPR

Simone van der Hof and Eva Lievens Simone van der Hof and Eva Lievens

1. Introduction data in a more meaningful way. To realise this, a 1. Introduction data in a more meaningful way. To realise this, a comprehensive approach towards the protection of comprehensive approach towards the protection of The General Data Protection Regulation that enters children’s personal data is needed, which adopts a The General Data Protection Regulation that enters children’s personal data is needed, which adopts a in to force on 25 May 2018 aims speciﬁcally to rights-based perspective (focused not only on protec- in to force on 25 May 2018 aims speciﬁcally to rights-based perspective (focused not only on protec- protect children and their personal data in the digital tion, but also on emancipation/participation and protect children and their personal data in the digital tion, but also on emancipation/participation and world. According to Recital 38, children ’may be development) and takes advantage of the full potential world. According to Recital 38, children ’may be development) and takes advantage of the full potential less aware of the risks, consequences and safeguards of protective mechanisms offered under the GDPR. less aware of the risks, consequences and safeguards of protective mechanisms offered under the GDPR. concerned and their rights in relation to the proces- Provisions that do not explicitly mention children concerned and their rights in relation to the proces- Provisions that do not explicitly mention children sing of personal data’. Although indeed a laudable but are especially important for them, such as the sing of personal data’. Although indeed a laudable but are especially important for them, such as the and relevant measure, the GDPR demonstrates many principles of privacy by design and privacy by default and relevant measure, the GDPR demonstrates many principles of privacy by design and privacy by default questions as to what said protection entails and how as well as data protection impact assessments, should questions as to what said protection entails and how as well as data protection impact assessments, should it can be effectively achieved. It is for instance highly feature prominently in such a holistic approach. it can be effectively achieved. It is for instance highly feature prominently in such a holistic approach. questionable whether parental consent, as required by questionable whether parental consent, as required by Article 8 GDPR, will actually be an adequate mecha- This article aims to explore to what extent the current Article 8 GDPR, will actually be an adequate mecha- This article aims to explore to what extent the current nism to protect children (Van der Hof, 2017). Consent illusion of autonomy and control by data subjects, nism to protect children (Van der Hof, 2017). Consent illusion of autonomy and control by data subjects, is completely ineffective in practice due to consent including children and parents, based on consent can is completely ineffective in practice due to consent including children and parents, based on consent can overload, information overload, complexity of data potentially be mitigated, or even reversed, by putting overload, information overload, complexity of data potentially be mitigated, or even reversed, by putting processing, and lack of actual choice (Schermer et al, more emphasis on other tools of protection and processing, and lack of actual choice (Schermer et al, more emphasis on other tools of protection and 2014). What is more, depending on how strictly this empowerment in the GDPR and their opportunities 2014). What is more, depending on how strictly this empowerment in the GDPR and their opportunities provision is enforced and implemented, negative side for children. Suggestions will be put forward as to how provision is enforced and implemented, negative side for children. Suggestions will be put forward as to how effects may emerge that endanger, rather than protect the adoption of such tools may enhance children’s effects may emerge that endanger, rather than protect the adoption of such tools may enhance children’s or respect, a whole range of children’s fundamental rights and how they could be put into practice by data or respect, a whole range of children’s fundamental rights and how they could be put into practice by data rights. A genuine risk, for instance, exists of children protection authorities (DPAs) and data controllers. rights. A genuine risk, for instance, exists of children protection authorities (DPAs) and data controllers. being excluded from online services, which might This article starts by setting out how Article 8 GDPR being excluded from online services, which might This article starts by setting out how Article 8 GDPR adversely impact their rights to development, informa- intends to protect children of certain ages and how adversely impact their rights to development, informa- intends to protect children of certain ages and how tion, freedom of expression, association, privacy, play, such protection seems illusory given the complexi- tion, freedom of expression, association, privacy, play, such protection seems illusory given the complexi- and education laid down in the 1989 United Nations ties of the digital world, which is largely dominated and education laid down in the 1989 United Nations ties of the digital world, which is largely dominated Convention on the Rights of the Child (UNCRC).1 by commercial interests and even clashes with other Convention on the Rights of the Child (UNCRC).1 by commercial interests and even clashes with other interests and rights of children (section 2). The article interests and rights of children (section 2). The article However, despite its inadequacies the GDPR also will then explore how other data protection instru- However, despite its inadequacies the GDPR also will then explore how other data protection instru- provides opportunities to protect children’s personal ments, ie privacy by design and data protection provides opportunities to protect children’s personal ments, ie privacy by design and data protection

Communications Law Vol. 23, No. 1, 2018 33 Communications Law Vol. 23, No. 1, 2018 33 The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR

impact assessments, might potentially relieve some mostly use vague terms anyway. A lot of apps do not impact assessments, might potentially relieve some mostly use vague terms anyway. A lot of apps do not of the issues identified in earlier sections, eg by filling even have privacy policies.10 of the issues identified in earlier sections, eg by filling even have privacy policies.10 some of the existing gaps in protection of children some of the existing gaps in protection of children or by balancing control over children’s personal data Second, the requirement of parental consent for or by balancing control over children’s personal data Second, the requirement of parental consent for with other children’s interests and rights (section 3). children below a certain age potentially might put with other children’s interests and rights (section 3). children below a certain age potentially might put The article wraps up with conclusions (section 4). the emancipation and participation rights of those The article wraps up with conclusions (section 4). the emancipation and participation rights of those children under pressure. The requirement can lead children under pressure. The requirement can lead to excessive parental supervision which potentially to excessive parental supervision which potentially 2. Children’s and parental violates the privacy rights of children.11 For teens, 2. Children’s and parental violates the privacy rights of children.11 For teens, consent: an ineffective means absence of parents and having their own spaces – consent: an ineffective means absence of parents and having their own spaces – of child protection also online – free from parental supervision can be of child protection also online – free from parental supervision can be perceived as important privacy needs.12 Moreover, the perceived as important privacy needs.12 Moreover, the requirement can, and in some instances already does, requirement can, and in some instances already does, The aim of protecting children in the GDPR most ban children from certain online services, if and when The aim of protecting children in the GDPR most ban children from certain online services, if and when clearly stands out in its Article 8,2 which is fully social media and other online service providers set clearly stands out in its Article 8,2 which is fully social media and other online service providers set dedicated to assigning legal capacity with respect age limits for use or subscription in order to avoid the dedicated to assigning legal capacity with respect age limits for use or subscription in order to avoid the to decisions over lawful processing of children’s – rather burdensome – parental consent requirement. to decisions over lawful processing of children’s – rather burdensome – parental consent requirement. personal data to parents (or their (legal) representa- An example is Google, which does not allow children personal data to parents (or their (legal) representa- An example is Google, which does not allow children tives) when children are still too uncomprehending for whom parental consent is required to have own tives) when children are still too uncomprehending for whom parental consent is required to have own and unaware to make those decisions themselves.3 accounts on its platforms.13 Hence, even if protection and unaware to make those decisions themselves.3 accounts on its platforms.13 Hence, even if protection The GDPR assumes that children of 16 and younger of children’s personal data could be guaranteed by The GDPR assumes that children of 16 and younger of children’s personal data could be guaranteed by fall in that category, because that is the age stipulated Article 8, paradoxically it might still infringe on other fall in that category, because that is the age stipulated Article 8, paradoxically it might still infringe on other in Article 8 GDPR until which parents are required to fundamental rights of children (such as freedom of in Article 8 GDPR until which parents are required to fundamental rights of children (such as freedom of give consent for the lawful processing of their child- expression, laid down in Art 13 UNCRC) and defy give consent for the lawful processing of their child- expression, laid down in Art 13 UNCRC) and defy ren’s personal data in relation to information society important freedoms in those areas. ren’s personal data in relation to information society important freedoms in those areas. services after children’s personal data. However, services after children’s personal data. However, conclusive empirical data as to whether and, if so, at Third, there are significant gaps in the development conclusive empirical data as to whether and, if so, at Third, there are significant gaps in the development what age children understand those decisions does of children when it comes to understanding the what age children understand those decisions does of children when it comes to understanding the not exist.4 Moreover, the provision leaves Member digital environment in which they must consent to the not exist.4 Moreover, the provision leaves Member digital environment in which they must consent to the States discretional power to diverge from the general processing of their personal data.14 Although the situa- States discretional power to diverge from the general processing of their personal data.14 Although the situa- rule by setting a lower age as long as they do not tion may differ amongst countries, digital citizenship rule by setting a lower age as long as they do not tion may differ amongst countries, digital citizenship go below 13.5 Apparently, this is a consequence education may not always be part of the curriculum go below 13.5 Apparently, this is a consequence education may not always be part of the curriculum of divergent ages for legal capacity of children in of schools, and if it is, it may not focus specifically of divergent ages for legal capacity of children in of schools, and if it is, it may not focus specifically Member States’ private laws and, again, not in any on the digital economy. In order to make decisions Member States’ private laws and, again, not in any on the digital economy. In order to make decisions way evidence-based.6 Besides the lack of evidence on about the processing of one’s personal data, however, way evidence-based.6 Besides the lack of evidence on about the processing of one’s personal data, however, what children understand as consumers of the digital it is imperative to understand the underlying profit- what children understand as consumers of the digital it is imperative to understand the underlying profit- economy, Article 8 GDPR raises other problems with induced processes of the digital economy, which have economy, Article 8 GDPR raises other problems with induced processes of the digital economy, which have respect to protecting children. their own dynamics and are not – necessarily – an respect to protecting children. their own dynamics and are not – necessarily – an extension of the offline world, to the extent that that extension of the offline world, to the extent that that First, the protection it offers to data subjects may world still exists anyway. What is more, many of these First, the protection it offers to data subjects may world still exists anyway. What is more, many of these be very limited, or even illusory. The instrument of processes by which data subjects become increasingly be very limited, or even illusory. The instrument of processes by which data subjects become increasingly consent is fallible as a protective tool for a number transparent to corporations are intentionally invisible consent is fallible as a protective tool for a number transparent to corporations are intentionally invisible of reasons.7 Consent suggests that we are in control to us so as not to undermine their effectiveness – what of reasons.7 Consent suggests that we are in control to us so as not to undermine their effectiveness – what over the processing of our personal data, but this Keymolen calls ‘invisible visibility’.15 Moreover, they over the processing of our personal data, but this Keymolen calls ‘invisible visibility’.15 Moreover, they implies that we have a meaningful choice and unders- have become so complex that even opening up the implies that we have a meaningful choice and unders- have become so complex that even opening up the tand data processing practices of controllers. Consent black box would not necessarily result in the transpa- tand data processing practices of controllers. Consent black box would not necessarily result in the transpa- requires free choice,8 but if you want to sign up for rency that we seek.16 requires free choice,8 but if you want to sign up for rency that we seek.16 online services or apps, there normally is no choice online services or apps, there normally is no choice other than saying yes to a company’s privacy policy other than saying yes to a company’s privacy policy (and hence data processing practices), or leave it be (and hence data processing practices), or leave it be altogether, given that privacy policies (and hence the altogether, given that privacy policies (and hence the use of the app or online service) are offered on a take- use of the app or online service) are offered on a take- it-or-leave-it basis. Moreover, individuals often do not it-or-leave-it basis. Moreover, individuals often do not know what they consent to – privacy policies are not know what they consent to – privacy policies are not read (too difficult, too time-consuming) – 9 nor would read (too difficult, too time-consuming) – 9 nor would it be enlightening if they were read because they it be enlightening if they were read because they

34 Communications Law Vol. 23, No. 1, 2018 34 Communications Law Vol. 23, No. 1, 2018 The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR

3. Other tools of child implemented and the extent to which engineers will 3. Other tools of child implemented and the extent to which engineers will protection and empowerment both be capable and willing to effectively shape data protection and empowerment both be capable and willing to effectively shape data in the GDPR: novel protection arrangements in the systems’ architecture. in the GDPR: novel protection arrangements in the systems’ architecture. This part of the article will set out the meaning of each This part of the article will set out the meaning of each opportunities of these principles (section 3.2.1.) and explore ways of opportunities of these principles (section 3.2.1.) and explore ways of implementing them in view of the need to guarantee implementing them in view of the need to guarantee 3.1 Introduction the rights of children and the protection of their 3.1 Introduction the rights of children and the protection of their personal data (section 3.2.2.). personal data (section 3.2.2.). The GDPR provides instruments for protection that The GDPR provides instruments for protection that are focused on data subjects irrespective of age or 3.2.1. The principles of data protection by are focused on data subjects irrespective of age or 3.2.1. The principles of data protection by capacity, and hence include, but are not specifi- design and default capacity, and hence include, but are not specifi- design and default cally geared towards, the situation of children and cally geared towards, the situation of children and therefore the protection of their personal data. In The principles of data protection by design and therefore the protection of their personal data. In The principles of data protection by design and the following sections, we will discuss more particu- default are regulated in Article 25 GDPR, which more the following sections, we will discuss more particu- default are regulated in Article 25 GDPR, which more larly the principles of privacy by design and privacy specifically elaborates the responsibility of controllers larly the principles of privacy by design and privacy specifically elaborates the responsibility of controllers by default, as well as data protection impact assess- already stated under Article 24 GDPR. by default, as well as data protection impact assess- already stated under Article 24 GDPR. ments. Even though these tools are of a more general ments. Even though these tools are of a more general nature, we argue that from a children’s rights perspec- According to Article 25 (1) GDPR, controllers must: nature, we argue that from a children’s rights perspec- According to Article 25 (1) GDPR, controllers must: tive controllers and processors17 have the obligation to tive controllers and processors17 have the obligation to take into account the best interests and rights of the implement appropriate technical and organi- take into account the best interests and rights of the implement appropriate technical and organi- child,18 when implementing them within or applying sational measures, such as pseudonymisation, child,18 when implementing them within or applying sational measures, such as pseudonymisation, them to their organisational and technical processes which are designed to implement data-protec- them to their organisational and technical processes which are designed to implement data-protec- as well as, desirably, to adapt a rights-based approach tion principles, such as data minimisation, in an as well as, desirably, to adapt a rights-based approach tion principles, such as data minimisation, in an – ie an implementation that besides protection also effective manner and to integrate the necessary – ie an implementation that besides protection also effective manner and to integrate the necessary focuses on participation and development of children. safeguards into the processing in order to meet the focuses on participation and development of children. safeguards into the processing in order to meet the In the following sections, we will first address the requirements of this Regulation and protect the In the following sections, we will first address the requirements of this Regulation and protect the principles of privacy by design and default (section rights of data subjects (privacy by design, authors’ principles of privacy by design and default (section rights of data subjects (privacy by design, authors’ 3.2.) and then data protection impact assessments emphasis). 3.2.) and then data protection impact assessments emphasis). (section 3.3.). (section 3.3.). The data protection principles to which the provision The data protection principles to which the provision 3.2 The principles of data protection by refers are those specified in Article 5 GDPR. These 3.2 The principles of data protection by refers are those specified in Article 5 GDPR. These design and privacy by default principles are: design and privacy by default principles are:

Although not entirely new concepts, the inclusion Q lawfulness, fairness and transparency; Although not entirely new concepts, the inclusion Q lawfulness, fairness and transparency; of the principles of data protection by default and of the principles of data protection by default and data protection by design in the GDPR are regulatory Q purpose limitation; data protection by design in the GDPR are regulatory Q purpose limitation; innovations that can boost the protection of children innovations that can boost the protection of children if implemented well and with children in mind. These Q data minimisation; if implemented well and with children in mind. These Q data minimisation; principles require that controllers implement data principles require that controllers implement data protection principles into the design of their data Q accuracy; protection principles into the design of their data Q accuracy; processing systems. As mentioned previously neither processing systems. As mentioned previously neither of these principles is focused specifically on children, Q storage limitation; of these principles is focused specifically on children, Q storage limitation; but with the aim of the GDPR to protect children but with the aim of the GDPR to protect children in mind these principles particularly hold oppor- Q integrity and confidentiality. in mind these principles particularly hold oppor- Q integrity and confidentiality. tunities that might mitigate some of the problems tunities that might mitigate some of the problems with individual – children’s or parental – control According to Article 25 (2) GDPR, controllers must: with individual – children’s or parental – control According to Article 25 (2) GDPR, controllers must: over personal data.19 First, they can ensure that data over personal data.19 First, they can ensure that data protection becomes part and parcel of data proces- implement appropriate technical and organisa- protection becomes part and parcel of data proces- implement appropriate technical and organisa- sing systems without individuals necessarily needing tional measures for ensuring that, by default, only sing systems without individuals necessarily needing tional measures for ensuring that, by default, only to fully comprehend the frequently complex internal personal data which are necessary for each to fully comprehend the frequently complex internal personal data which are necessary for each data processing practices of controllers. Second, specific purpose of the processing are processed data processing practices of controllers. Second, specific purpose of the processing are processed they provide opportunities to integrate individual (privacy by default, authors’ emphasis). they provide opportunities to integrate individual (privacy by default, authors’ emphasis). control rights into the data systems operation, hence control rights into the data systems operation, hence potentially making them both more transparent and potentially making them both more transparent and effective. Obviously, the impact of these principles effective. Obviously, the impact of these principles depends largely on the ways in which they are depends largely on the ways in which they are

Communications Law Vol. 23, No. 1, 2018 35 Communications Law Vol. 23, No. 1, 2018 35 The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR

Although these principles are often mostly associated Unfortunately, the GDPR does not make that connec- Although these principles are often mostly associated Unfortunately, the GDPR does not make that connec- with value-sensitive technological design, clearly tion, not explicitly at least. Obviously, children might with value-sensitive technological design, clearly tion, not explicitly at least. Obviously, children might they also encompass organisational measures, such benefit from implementations of these principles they also encompass organisational measures, such benefit from implementations of these principles as internal business policies and practices. Measures similarly to adults, not necessarily needing speci- as internal business policies and practices. Measures similarly to adults, not necessarily needing speci- could more specifically include, amongst others, fically child-focused privacy by design and default could more specifically include, amongst others, fically child-focused privacy by design and default ‘minimising the processing of personal data, pseudo- measures. However, their exceptional position under ‘minimising the processing of personal data, pseudo- measures. However, their exceptional position under nymising personal data as soon as possible, transpa- the GDPR, given the profound concerns in respect nymising personal data as soon as possible, transpa- the GDPR, given the profound concerns in respect rency with regard to the functions and processing of of their vulnerability,21 certainly justifies a child- rency with regard to the functions and processing of of their vulnerability,21 certainly justifies a child- personal data, enabling the data subject to monitor centred implementation of data protection by design personal data, enabling the data subject to monitor centred implementation of data protection by design the data processing, enabling the controller to create in relation to data processing activities that involve the data processing, enabling the controller to create in relation to data processing activities that involve and improve security features’ (Recital 78). The imple- children’s personal data. This is also recognised in and improve security features’ (Recital 78). The imple- children’s personal data. This is also recognised in mentation of measures based on these principles the context of the Council of Europe Strategy for mentation of measures based on these principles the context of the Council of Europe Strategy for is also tantamount to encouraging compliance by the Rights of the Child, which has resulted in draft is also tantamount to encouraging compliance by the Rights of the Child, which has resulted in draft controllers (and others) with respect to observing the ‘Guidelines to promote, protect and fulfil children’s controllers (and others) with respect to observing the ‘Guidelines to promote, protect and fulfil children’s rights of data subjects and fulfilling their obligations rights in the digital environment’22 that specifically rights of data subjects and fulfilling their obligations rights in the digital environment’22 that specifically pursuant to the GDPR more generally, ie: mention that privacy by design and default must take pursuant to the GDPR more generally, ie: mention that privacy by design and default must take into account the best interests of the child.23 This first into account the best interests of the child.23 This first [w]hen developing, designing, selecting and using raises the question on which children such a child- [w]hen developing, designing, selecting and using raises the question on which children such a child- applications, services and products that are based centred approach should be focused given the lack of applications, services and products that are based centred approach should be focused given the lack of on the processing of personal data or process a definition of ‘child’ in the GDPR. Since the GDPR on the processing of personal data or process a definition of ‘child’ in the GDPR. Since the GDPR personal data to fulfil their task, producers of the has only explicitly determined ages in a specific situa- personal data to fulfil their task, producers of the has only explicitly determined ages in a specific situa- products, services and applications should be tion (children’s and parental consent, Art 8 GDPR) products, services and applications should be tion (children’s and parental consent, Art 8 GDPR) encouraged to take into account the right to data we argue that it is most logical to turn to the generally encouraged to take into account the right to data we argue that it is most logical to turn to the generally protection when developing and designing such accepted definition of the UNCRC, ie a person under protection when developing and designing such accepted definition of the UNCRC, ie a person under products, services and applications and, with the age of 18,24 in those instances where the GDPR products, services and applications and, with the age of 18,24 in those instances where the GDPR due regard to the state of the art, to make sure that has left this matter open. In the same fashion, we due regard to the state of the art, to make sure that has left this matter open. In the same fashion, we controllers and processors are able to fulfil their would argue that in each situation where it is likely, or controllers and processors are able to fulfil their would argue that in each situation where it is likely, or data protection obligations (Recital 78, authors’ at least not excluded, that personal data of children data protection obligations (Recital 78, authors’ at least not excluded, that personal data of children emphasis). will processed by the controller (and others),25 a child- emphasis). will processed by the controller (and others),25 a child- centred approach towards data protection by design centred approach towards data protection by design One example of a technical measure that controllers and default is desirable. As a consequence, such an One example of a technical measure that controllers and default is desirable. As a consequence, such an can implement in their systems design is the pseudo- obligation would be further reaching than Article can implement in their systems design is the pseudo- obligation would be further reaching than Article nymisation of personal data, which entails a process 8’s limitation to information society services that are nymisation of personal data, which entails a process 8’s limitation to information society services that are pursuant to which personal data can no longer be offered directly to a child and also encompasses, for pursuant to which personal data can no longer be offered directly to a child and also encompasses, for attributed to a particular individual without the use of example, youth-care or school-administration systems. attributed to a particular individual without the use of example, youth-care or school-administration systems. additional information which is kept securely apart (see additional information which is kept securely apart (see Art 4(5) GDPR). Hence, the process can be potentially When it comes to the implementation of the Art 4(5) GDPR). Hence, the process can be potentially When it comes to the implementation of the reversed which distinguishes it from anonymisation, principles of data protection by design and default in reversed which distinguishes it from anonymisation, principles of data protection by design and default in although the difference between the two is not straight- a child-centred manner, several examples immedia- although the difference between the two is not straight- a child-centred manner, several examples immedia- forward in practice.20 However, as the previous expla- tely spring to mind. Some data subject rights, being forward in practice.20 However, as the previous expla- tely spring to mind. Some data subject rights, being nations reveal, the principles clearly go beyond mere express manifestations of data processing principles nations reveal, the principles clearly go beyond mere express manifestations of data processing principles minimisation of personal data, even though an impor- to which Article 25 refers, clearly have particular minimisation of personal data, even though an impor- to which Article 25 refers, clearly have particular tant data protection principle in and of itself. Moreover, importance in relation to children, either as expli- tant data protection principle in and of itself. Moreover, importance in relation to children, either as expli- the implementation of these principles can and are citly recognised by the GDPR (eg right to transpa- the implementation of these principles can and are citly recognised by the GDPR (eg right to transpa- likely to be furthered by certification schemes (Art 25 rency and right not to be subjected to certain types likely to be furthered by certification schemes (Art 25 rency and right not to be subjected to certain types GDPR) and codes of conduct (Art 40(2)(h) GDPR). of profiling) or because these rights are perceived as GDPR) and codes of conduct (Art 40(2)(h) GDPR). of profiling) or because these rights are perceived as especially beneficial to children (eg right to erasure, especially beneficial to children (eg right to erasure, 3.2.2. A child-centred approach towards data also called the ‘right to be forgotten’). Each of these 3.2.2. A child-centred approach towards data also called the ‘right to be forgotten’). Each of these protection by design and default three examples will be briefly elaborated on. protection by design and default three examples will be briefly elaborated on.

Since children are a dedicated category of indivi- First, the GDPR explicitly mentions the protection of Since children are a dedicated category of indivi- First, the GDPR explicitly mentions the protection of duals demanding stricter data protection under the children in relation to transparency of data processing duals demanding stricter data protection under the children in relation to transparency of data processing GDPR, the principles of data protection by design practices and proﬁling. The principle of transparency GDPR, the principles of data protection by design practices and proﬁling. The principle of transparency and default seem particularly apt to encourage and (see Art 5(1)(a) GDPR) has been developed in Arts and default seem particularly apt to encourage and (see Art 5(1)(a) GDPR) has been developed in Arts ensure the protection of their personal data – and, at 12, 13 and 14 GDPR, which puts a duty on control- ensure the protection of their personal data – and, at 12, 13 and 14 GDPR, which puts a duty on control- the same time, guarantee their rights more generally. lers to provide information on their data processing the same time, guarantee their rights more generally. lers to provide information on their data processing

36 Communications Law Vol. 23, No. 1, 2018 36 Communications Law Vol. 23, No. 1, 2018 The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR practices and data subject rights ‘in a concise, trans- Third, the right to erasure in the GDPR, more practices and data subject rights ‘in a concise, trans- Third, the right to erasure in the GDPR, more parent, intelligible and easily accessible form, using popularly called the ‘right to be forgotten’, entails a parent, intelligible and easily accessible form, using popularly called the ‘right to be forgotten’, entails a clear and plain language, in particular for any infor- data subject right to have own personal data erased, clear and plain language, in particular for any infor- data subject right to have own personal data erased, mation addressed specifically to a child’ (Art 12(1)).26 for, amongst other reasons, when personal data is no mation addressed specifically to a child’ (Art 12(1)).26 for, amongst other reasons, when personal data is no Article 12(7) mentions the use of icons27 to convey ‘in longer necessary given processing purposes; the data Article 12(7) mentions the use of icons27 to convey ‘in longer necessary given processing purposes; the data an easily visible, intelligible and clearly legible manner subject withdraws his or her consent or objects to the an easily visible, intelligible and clearly legible manner subject withdraws his or her consent or objects to the a meaningful overview of the intended processing’. processing of personal data; or personal data is unlaw- a meaningful overview of the intended processing’. processing of personal data; or personal data is unlaw- Such icons must be machine-readable if presented fully processed (Art 17(1) GDPR).35 Given their vulne- Such icons must be machine-readable if presented fully processed (Art 17(1) GDPR).35 Given their vulne- electronically, which clearly indicates a transparency rability, the right is perceived as especially important electronically, which clearly indicates a transparency rability, the right is perceived as especially important by design solution that can be understood as covered with respect to personal data processed while the by design solution that can be understood as covered with respect to personal data processed while the more broadly by the principle of data protection by data subject was still a child (Recital 65).36 The right more broadly by the principle of data protection by data subject was still a child (Recital 65).36 The right design. However, a more far-reaching data protec- to erasure is grounded in the idea that individuals design. However, a more far-reaching data protec- to erasure is grounded in the idea that individuals tion by design solution would entail making transpa- should have control over their personal data37 and is tion by design solution would entail making transpa- should have control over their personal data37 and is rency an integral part of the process of data processing often phrased in terms of the ‘clean slate’ argument: rency an integral part of the process of data processing often phrased in terms of the ‘clean slate’ argument: practices, eg by clearly and instantaneously showing whatever youthful sins while growing up, they should practices, eg by clearly and instantaneously showing whatever youthful sins while growing up, they should important events or changes in data processing not haunt a person into adulthood.38 Also, personal important events or changes in data processing not haunt a person into adulthood.38 Also, personal systems to users, or by giving them a visualisation and data that has been collected in relation to the offer of systems to users, or by giving them a visualisation and data that has been collected in relation to the offer of accessible tools to tweak data processing in a control information society services directly to children must accessible tools to tweak data processing in a control information society services directly to children must panel. Here we will not go further into the question be erased at the request of the data subject (see Art panel. Here we will not go further into the question be erased at the request of the data subject (see Art of what could potentially be effective ways of data 8(1)(f) GDPR). If personal data has been published of what could potentially be effective ways of data 8(1)(f) GDPR). If personal data has been published protection by design for transparency purposes, but in or shared with third parties, controllers have an protection by design for transparency purposes, but in or shared with third parties, controllers have an relation to children it is important that they need to be obligation to attempt to inform third party control- relation to children it is important that they need to be obligation to attempt to inform third party control- geared to their perceptions, experiences and expec- lers of data subject erasure requests (Art 17(2) and geared to their perceptions, experiences and expec- lers of data subject erasure requests (Art 17(2) and tations. This is not an easy task and requires research 19 GDPR). Although the right to erasure is triggered tations. This is not an easy task and requires research 19 GDPR). Although the right to erasure is triggered into what works for children and at what ages, given at the request of the data subject for which acces- into what works for children and at what ages, given at the request of the data subject for which acces- that their capacities are still developing.28 Moreover, sible and easy-to-use electronic procedures should that their capacities are still developing.28 Moreover, sible and easy-to-use electronic procedures should the extent to which they will be able to comprehend be in place in the digital environment (see Recital 59 the extent to which they will be able to comprehend be in place in the digital environment (see Recital 59 data processing practices in a meaningful way is also GDPR), it might also be implemented as a privacy by data processing practices in a meaningful way is also GDPR), it might also be implemented as a privacy by dependent upon their level of understanding of the design strategy. This would fit with a proposal by the dependent upon their level of understanding of the design strategy. This would fit with a proposal by the power dynamics in the digital data economy and how Canadian Public Interest Advocacy Centre (PIAC) that power dynamics in the digital data economy and how Canadian Public Interest Advocacy Centre (PIAC) that they impact on them as individuals – and hence the could be implemented as a default erasure function, they impact on them as individuals – and hence the could be implemented as a default erasure function, choices that they make – and society as a whole.29 unless consent is obtained from or renewed while the choices that they make – and society as a whole.29 unless consent is obtained from or renewed while the child has come of age: child has come of age: Second, under the GDPR data subjects have in Second, under the GDPR data subjects have in principle30 the right not to be subject to automated Once children reach the age of majority, organi- principle30 the right not to be subject to automated Once children reach the age of majority, organi- individual decision-making, including profiling (Art sations that have collected and used personal individual decision-making, including profiling (Art sations that have collected and used personal 22).31 Although Article 22 does not explicitly refer information should no longer be permitted to 22).31 Although Article 22 does not explicitly refer information should no longer be permitted to to children, Recital 71 states that ‘[s]uch a measure retain the information gathered during the child’s to children, Recital 71 states that ‘[s]uch a measure retain the information gathered during the child’s should not concern a child’. Given that it refers to ‘legal minority’ and should be required to remove should not concern a child’. Given that it refers to ‘legal minority’ and should be required to remove ‘measure’ as ‘evaluating personal aspects relating the information immediately unless the newly ‘measure’ as ‘evaluating personal aspects relating the information immediately unless the newly to him or her which is based solely on automated adult person gives his or her explicit consent to to him or her which is based solely on automated adult person gives his or her explicit consent to processing and which produces legal effects concer- the continued collection, use and possible future processing and which produces legal effects concer- the continued collection, use and possible future ning him or her or similarly significantly affects him disclosure of their personal information gathered ning him or her or similarly significantly affects him disclosure of their personal information gathered or her’, we can assume that profiling is meant. As during their minority.39 or her’, we can assume that profiling is meant. As during their minority.39 a consequence, organisations need to distinguish a consequence, organisations need to distinguish between children and adults32 when profiling data Given the right to control own personal data as well between children and adults32 when profiling data Given the right to control own personal data as well subjects leading to decisions that produce legal as other fundamental rights (notably the rights to subjects leading to decisions that produce legal as other fundamental rights (notably the rights to effects or similarly significantly affect them, assuming freedom of expression, freedom of association and effects or similarly significantly affect them, assuming freedom of expression, freedom of association and that profiling is otherwise in compliance with data privacy), such a function necessarily depends on that profiling is otherwise in compliance with data privacy), such a function necessarily depends on protection regulation. Data processing processes the consent of the data subject. Controllers cannot protection regulation. Data processing processes the consent of the data subject. Controllers cannot can thus be designed33 in ways that automatically assume that data subjects will want their personal can thus be designed33 in ways that automatically assume that data subjects will want their personal rule out personal data which holds attributes pertai- data collected during youth erased, nor are they likely rule out personal data which holds attributes pertai- data collected during youth erased, nor are they likely ning to persons under 1834 as well as refrain from to be inclined to act without further notice by data ning to persons under 1834 as well as refrain from to be inclined to act without further notice by data applying the results of profiling processes to these subjects. However, the possibility must nonetheless applying the results of profiling processes to these subjects. However, the possibility must nonetheless persons. be part of internal organisation processes and can be persons. be part of internal organisation processes and can be proactively offered to data subjects. proactively offered to data subjects.

Communications Law Vol. 23, No. 1, 2018 37 Communications Law Vol. 23, No. 1, 2018 37 The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR

Obviously, this ties in with the principle of privacy natural persons based on profiling.41 According to Obviously, this ties in with the principle of privacy natural persons based on profiling.41 According to by default (eg no publishng of personal data in a the Article 29 Working Party’s ‘Guidelines on Data by default (eg no publishng of personal data in a the Article 29 Working Party’s ‘Guidelines on Data social media profile unless the data subject has opted Protection Impact Assessment (DPIA) and determining social media profile unless the data subject has opted Protection Impact Assessment (DPIA) and determining otherwise) and providing data subjects access to whether processing is “likely to result in a high risk” otherwise) and providing data subjects access to whether processing is “likely to result in a high risk” data processing practices in relation to their personal for the purposes of Regulation 2016/679’, a DPIA is data processing practices in relation to their personal for the purposes of Regulation 2016/679’, a DPIA is data (see Art 15 GDPR, on the right of access of the a ‘process designed to describe the processing, assess data (see Art 15 GDPR, on the right of access of the a ‘process designed to describe the processing, assess subject)40 as well as the opportunity to request a the necessity and proportionality of a processing and subject)40 as well as the opportunity to request a the necessity and proportionality of a processing and restriction on the processing of their personal data to help manage the risks to the rights and freedoms restriction on the processing of their personal data to help manage the risks to the rights and freedoms (see Art 18 GDPR). Again, despite effective imple- of natural persons resulting from the processing of (see Art 18 GDPR). Again, despite effective imple- of natural persons resulting from the processing of mentation, exercising such control requires sufficient personal data (by assessing them and determining the mentation, exercising such control requires sufficient personal data (by assessing them and determining the understanding of data processing practices and their – measures to address them)’.42 understanding of data processing practices and their – measures to address them)’.42 potential – implications for the data subject. potential – implications for the data subject. 3.3.2 Should a data protection impact 3.3.2 Should a data protection impact 3.3 Data protection impact assessments assessment be carried out for the processing 3.3 Data protection impact assessments assessment be carried out for the processing of personal data of children? of personal data of children? 3.3.1 Data protection impact assessments in 3.3.1 Data protection impact assessments in the GDPR The GDPR does not explicitly43 consider the proces- the GDPR The GDPR does not explicitly43 consider the processing of personal of data of children as such to be a sing of personal of data of children as such to be a Aside from the potential of the principles of privacy processing activity that carries a high risk,44 but in Aside from the potential of the principles of privacy processing activity that carries a high risk,44 but in by design and by default, there is another interes- the light of Recital 38 it could be argued that it is by design and by default, there is another interes- the light of Recital 38 it could be argued that it is ting tool that could enhance meaningful protection a good practice to carry out a DPIA in such cases. ting tool that could enhance meaningful protection a good practice to carry out a DPIA in such cases. of the processing of children’s personal data. The Furthermore, the Article 29 Working Party has identi- of the processing of children’s personal data. The Furthermore, the Article 29 Working Party has identi- GDPR includes in Article 35 an obligation for data fied a number of criteria in order to assess whether a GDPR includes in Article 35 an obligation for data fied a number of criteria in order to assess whether a controllers to assess the impact of processing opera- DPIA should be carried out, listed in the figure below. controllers to assess the impact of processing opera- DPIA should be carried out, listed in the figure below. tions that are likely to result in a high risk to the rights tions that are likely to result in a high risk to the rights and freedoms of data subjects prior to processing. and freedoms of data subjects prior to processing. Such a ‘data protection impact assessment’ (DPIA) Such a ‘data protection impact assessment’ (DPIA) must, for instance, be carried out when personal data must, for instance, be carried out when personal data is processed for taking decisions regarding specific is processed for taking decisions regarding specific

DPIA? Likely high risk DPIA? Likely high risk to the rights and freedoms of individuals Article 35 GDPR to the rights and freedoms of individuals Article 35 GDPR

Criteria Criteria

Evaluation or scoring Evaluation or scoring

Automated decision-making w/legal effect Automated decision-making w/legal effect

Systematic monitoring Systematic monitoring

Sensitive data Sensitive data

Data processed on a large scale Data processed on a large scale Guidelines Guidelines Matching or combining datasets Matching or combining datasets Art. 29 WP Art. 29 WP Vulnerable data subjects Vulnerable data subjects

Innovative use or new solutions Innovative use or new solutions

Preventing data subjects from exercising a right Preventing data subjects from exercising a right

38 Communications Law Vol. 23, No. 1, 2018 38 Communications Law Vol. 23, No. 1, 2018 The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR

One of the criteria relates to data concerning vulne- targeted at children on the basis of profiling their One of the criteria relates to data concerning vulne- targeted at children on the basis of profiling their rable data subjects. According to the Working Party personal characteristics or behaviour may not only rable data subjects. According to the Working Party personal characteristics or behaviour may not only the processing of such data can require a DPIA compartmentalise children, but may also shape their the processing of such data can require a DPIA compartmentalise children, but may also shape their because of the ‘increased power imbalance between preferences and interests accordingly, ultimately because of the ‘increased power imbalance between preferences and interests accordingly, ultimately the data subject and the data controller, meaning the affecting their autonomy and their right to develop- the data subject and the data controller, meaning the affecting their autonomy and their right to develop- individual may be unable to consent to, or oppose, ment.49 Inspiration for undertaking a child rights- individual may be unable to consent to, or oppose, ment.49 Inspiration for undertaking a child rights- the processing of his or her data’. Children specifically oriented DPIA could be gathered from more general the processing of his or her data’. Children specifically oriented DPIA could be gathered from more general are singled out as not being ‘able to knowingly and child rights impact assessment tools, such as the ones are singled out as not being ‘able to knowingly and child rights impact assessment tools, such as the ones thoughtfully oppose or consent to the processing of developed by UNICEF.50 thoughtfully oppose or consent to the processing of developed by UNICEF.50 their data’. Even though it is considered that the more their data’. Even though it is considered that the more criteria are fulfilled by the processing operation, the In relation to the ‘best interests’ assessment criteria are fulfilled by the processing operation, the In relation to the ‘best interests’ assessment more likely it is to raise a high risk to the rights and mentioned under the previous section, the UN more likely it is to raise a high risk to the rights and mentioned under the previous section, the UN freedoms of data subjects, and therefore to require a Committee on the Rights of the Child considers this freedoms of data subjects, and therefore to require a Committee on the Rights of the Child considers this DPIA, it is also explicitly acknowledged that in some a general assessment of all relevant elements of the DPIA, it is also explicitly acknowledged that in some a general assessment of all relevant elements of the cases, a processing where only one of these criteria child’s best interests, the weight of each element cases, a processing where only one of these criteria child’s best interests, the weight of each element is present will require a DPIA.45 The UK Information depending on the others.51 Two additional important is present will require a DPIA.45 The UK Information depending on the others.51 Two additional important Commissioner’s Office draft ‘Children and the GDPR principles that are put forward by the Committee are Commissioner’s Office draft ‘Children and the GDPR principles that are put forward by the Committee are guidance’ also recommends the carrying out of also helpful in thinking about child rights-oriented guidance’ also recommends the carrying out of also helpful in thinking about child rights-oriented DPIAs, for instance by data controllers that regularly DPIAs. First, in situations where ‘protection’ factors DPIAs, for instance by data controllers that regularly DPIAs. First, in situations where ‘protection’ factors or systematically process personal data of children, to affecting a child (eg which may imply limitation or or systematically process personal data of children, to affecting a child (eg which may imply limitation or decide what steps need to be taken to verify age and restriction of rights) need to be assessed in relation decide what steps need to be taken to verify age and restriction of rights) need to be assessed in relation parental responsibility, or to assess the proportionality to measures of ‘empowerment’ (which implies full parental responsibility, or to assess the proportionality to measures of ‘empowerment’ (which implies full of restricting children’s freedom to learn, develop and exercise of children’s rights without restriction), the of restricting children’s freedom to learn, develop and exercise of children’s rights without restriction), the explore.46 age and maturity of the child should be guiding explore.46 age and maturity of the child should be guiding factors.52 This means that different measures may be factors.52 This means that different measures may be Notwithstanding the interpretation of whether or considered for younger and older children.53 Second, Notwithstanding the interpretation of whether or considered for younger and older children.53 Second, not DPIAs should be carried out for the processing data controllers must consider that the capacities of not DPIAs should be carried out for the processing data controllers must consider that the capacities of of children’s personal data based on the text of the children are not fixed, but will evolve. This entails of children’s personal data based on the text of the children are not fixed, but will evolve. This entails GDPR, Article 3 UNCRC requires that in all actions that measures must be revised or adjusted based on GDPR, Article 3 UNCRC requires that in all actions that measures must be revised or adjusted based on concerning children their best interests should be the physical, emotional, educational and other needs, concerning children their best interests should be the physical, emotional, educational and other needs, primary consideration.47 In other words, this principle and that possible scenarios for children’s development primary consideration.47 In other words, this principle and that possible scenarios for children’s development requires governments, public and private bodies to must be assessed and analysed in the short and long requires governments, public and private bodies to must be assessed and analysed in the short and long conduct child (rights) impact assessments and evaluate term.54 conduct child (rights) impact assessments and evaluate term.54 the impact of any proposed law, policy or decision on the impact of any proposed law, policy or decision on children’s rights.48 This requirement in itself provides a From a more practical perspective, a number of children’s rights.48 This requirement in itself provides a From a more practical perspective, a number of strong incentive to assess the risks to children’s rights important principles must be taken into account. First strong incentive to assess the risks to children’s rights important principles must be taken into account. First resulting from the processing of their personal data. and foremost, the DPIA must be carried out prior to resulting from the processing of their personal data. and foremost, the DPIA must be carried out prior to the processing. This is necessary to be able to mitigate the processing. This is necessary to be able to mitigate 3.3.3 How should a child rights-oriented possible risks before the processing starts, and is also 3.3.3 How should a child rights-oriented possible risks before the processing starts, and is also DPIA be carried out? inherently linked to the principles of privacy by design DPIA be carried out? inherently linked to the principles of privacy by design and by default. As the Information Commissioner’s and by default. As the Information Commissioner’s When undertaking a DPIA a data controller should Office has pointed out: ‘[i]t is usually easier to incor- When undertaking a DPIA a data controller should Office has pointed out: ‘[i]t is usually easier to incor- adopt a children’s rights perspective that takes into porate child friendly design into a system or product adopt a children’s rights perspective that takes into porate child friendly design into a system or product account the full range of children’s rights at stake. The as part of your initial design brief than to try and account the full range of children’s rights at stake. The as part of your initial design brief than to try and Article 29 Working Party stressed in its ‘Guidelines add it in later’.55 Second, the Article 29 Working Article 29 Working Party stressed in its ‘Guidelines add it in later’.55 Second, the Article 29 Working on Data Protection Impact Assessment’ that ‘the Party has emphasised that undertaking a DPIA is on Data Protection Impact Assessment’ that ‘the Party has emphasised that undertaking a DPIA is reference to “the rights and freedoms” of data not a ‘one-time exercise’.56 This means proces- reference to “the rights and freedoms” of data not a ‘one-time exercise’.56 This means proces- subjects primarily concerns the rights to data protec- sing practices should be continuously reviewed and subjects primarily concerns the rights to data protec- sing practices should be continuously reviewed and tion and privacy but may also involve other funda- regularly re-assessed. Third, it is important for a data tion and privacy but may also involve other funda- regularly re-assessed. Third, it is important for a data mental rights such as freedom of speech, freedom of controller to be transparent about DPIAs. Whereas mental rights such as freedom of speech, freedom of controller to be transparent about DPIAs. Whereas thought, freedom of movement, prohibition of discri- the publication of a DPIA is not explicitly required thought, freedom of movement, prohibition of discri- the publication of a DPIA is not explicitly required mination, right to liberty, conscience and religion’. by the GDPR, it is at least good practice to publish mination, right to liberty, conscience and religion’. by the GDPR, it is at least good practice to publish Data controllers should realise that other – essential the summary or conclusion.57 When a DPIA concerns Data controllers should realise that other – essential the summary or conclusion.57 When a DPIA concerns – rights that are attributed to children by the UNCRC the processing of personal data of children, a child- – rights that are attributed to children by the UNCRC the processing of personal data of children, a child- may be at risk when their personal data is processed. friendly publication is recommended. Finally, taking may be at risk when their personal data is processed. friendly publication is recommended. Finally, taking It has been argued, for instance, that advertising into account Article 12 UNCRC, which encompasses It has been argued, for instance, that advertising into account Article 12 UNCRC, which encompasses

Communications Law Vol. 23, No. 1, 2018 39 Communications Law Vol. 23, No. 1, 2018 39 The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR

the child’s right to be heard, participation of children, References the child’s right to be heard, participation of children, References in accordance with their age and maturity, should be in accordance with their age and maturity, should be integrated in the DPIA process. They are an important Article 29 Data Protection Working Party, ‘Guidelines integrated in the DPIA process. They are an important Article 29 Data Protection Working Party, ‘Guidelines external stakeholder whose views and voices should on Data Protection Impact Assessment (DPIA) and external stakeholder whose views and voices should on Data Protection Impact Assessment (DPIA) and be actively sought, on the one hand, and duly taken determining whether processing is “likely to result in be actively sought, on the one hand, and duly taken determining whether processing is “likely to result in into account, on the other hand.58 a high risk” for the purposes of Regulation 2016/679’, into account, on the other hand.58 a high risk” for the purposes of Regulation 2016/679’, (2017) 17/EN WP 248. http://ec.europa.eu/ (2017) 17/EN WP 248. http://ec.europa.eu/ newsroom/just/item-detail.cfm?item_id=50083. newsroom/just/item-detail.cfm?item_id=50083. 4. Conclusions 4. Conclusions Berg, B van den, Hof, S van der, ‘What happens to Berg, B van den, Hof, S van der, ‘What happens to Adopting a child-centred approach to the proces- my data? A novel approach to informing users of data Adopting a child-centred approach to the proces- my data? A novel approach to informing users of data sing of personal data of children naturally follows the processing practices’ (2012) First Monday, 17(7). sing of personal data of children naturally follows the processing practices’ (2012) First Monday, 17(7). rights of the child, but goes beyond mere compliance rights of the child, but goes beyond mere compliance with data protection law, and a sole focus on ‘protec- Bunn, A, ‘The curious case of the right to be forgotten’ with data protection law, and a sole focus on ‘protec- Bunn, A, ‘The curious case of the right to be forgotten’ tion’. It is essential to keep in mind that the rights to (2015) Computer Law & Security Review, 31(3), 336–50. tion’. It is essential to keep in mind that the rights to (2015) Computer Law & Security Review, 31(3), 336–50. privacy and data protection have important participa- privacy and data protection have important participa- tory dimensions for children, as they are essential for Bygrave, L, ‘Data Protection by Design and tory dimensions for children, as they are essential for Bygrave, L, ‘Data Protection by Design and their individual autonomy and self-determination, and by Default: Deciphering the EU’s Legislative their individual autonomy and self-determination, and by Default: Deciphering the EU’s Legislative preconditions for ‘participation’.59 Requirements’ (2017): https://www.idunn.no/file/ preconditions for ‘participation’.59 Requirements’ (2017): https://www.idunn.no/file/ pdf/66974311/data_protection_by_design_and_by_ pdf/66974311/data_protection_by_design_and_by_ Moreover, as important ‘protective’ methods that default_deciphering_the_.pdf. Moreover, as important ‘protective’ methods that default_deciphering_the_.pdf. are at the centre of the GDPR – such as parental are at the centre of the GDPR – such as parental consent – lead to the illusion of protection rather than Colesky, M, Hoepman, J-H, & Hillen, C ,‘A Critical consent – lead to the illusion of protection rather than Colesky, M, Hoepman, J-H, & Hillen, C ,‘A Critical meaningful control, a child rights-oriented approach Analysis of Privacy Design Strategies’, in (2016) IEEE meaningful control, a child rights-oriented approach Analysis of Privacy Design Strategies’, in (2016) IEEE must acknowledge the importance of emphasising the Security and Privacy Workshops (SPW) (2016) 33–40, must acknowledge the importance of emphasising the Security and Privacy Workshops (SPW) (2016) 33–40, accountability of the data controller, and empowering IEEE. accountability of the data controller, and empowering IEEE. children and parents. Putting the principles of privacy children and parents. Putting the principles of privacy by design and default into practice and carrying Friedman, B, Kahn, P H, & Borning, A, ‘Value by design and default into practice and carrying Friedman, B, Kahn, P H, & Borning, A, ‘Value out DPIAs in a child-centred manner has enormous Sensitive Design and Information Systems’ in The out DPIAs in a child-centred manner has enormous Sensitive Design and Information Systems’ in The potential in this regard. This will necessitate an inter- Handbook of Information and Computer Ethics (John potential in this regard. This will necessitate an inter- Handbook of Information and Computer Ethics (John disciplinary approach, in which cooperation between Wiley & Sons, Inc, 2008) 69-101. disciplinary approach, in which cooperation between Wiley & Sons, Inc, 2008) 69-101. lawyers, engineers and product or service developers lawyers, engineers and product or service developers will be simply indispensable. Hoepman, J H ,‘Privacy design strategies’ in N will be simply indispensable. Hoepman, J H ,‘Privacy design strategies’ in N Cuppens-Boulahia, F Cuppen, S Jajodia, A A El Kalam, Cuppens-Boulahia, F Cuppen, S Jajodia, A A El Kalam, Finally, and equally essentially, the putting into & T Sans (eds), ICT Systems Security and Privacy Finally, and equally essentially, the putting into & T Sans (eds), ICT Systems Security and Privacy practice of these promising tools must be based on Protection (Berlin, Springer, 2014) 446-59. practice of these promising tools must be based on Protection (Berlin, Springer, 2014) 446-59. solid evidence on the understanding and practices of solid evidence on the understanding and practices of children vis-à-vis processing operations, both now and Information Commissioner’s Office , ‘Children and children vis-à-vis processing operations, both now and Information Commissioner’s Office , ‘Children and with regard to emerging trends. the GDPR guidance’ (2017): https://ico.org.uk/media/ with regard to emerging trends. the GDPR guidance’ (2017): https://ico.org.uk/media/ about-the-ico/consultations/2172913/children-and- about-the-ico/consultations/2172913/children-and- Simone van der Hof the-gdpr-consultation-guidance-20171221.pdf. Simone van der Hof the-gdpr-consultation-guidance-20171221.pdf. Professor of Law and Digital Technologies, Leiden Professor of Law and Digital Technologies, Leiden University van der Hof, S, & Keymolen, E, ‘Shaping minors University van der Hof, S, & Keymolen, E, ‘Shaping minors with major shifts: Electronic child records in the with major shifts: Electronic child records in the Eva Lievens Netherlands’ (2010) Information Polity, 15(4). Eva Lievens Netherlands’ (2010) Information Polity, 15(4). Assistant Professor of Law and Technology, Ghent Assistant Professor of Law and Technology, Ghent University van der Hof, S,‘I Agree...or Do I? — A Rights-Based University van der Hof, S,‘I Agree...or Do I? — A Rights-Based Analysis of the Law on Children’s Consent in the Analysis of the Law on Children’s Consent in the Parts of this article build on research carried out in Digital World’ (2016) Wisconsin International Law Parts of this article build on research carried out in Digital World’ (2016) Wisconsin International Law the project ‘A children’s rights perspective on privacy Journal, 34(2), 409–45. the project ‘A children’s rights perspective on privacy Journal, 34(2), 409–45. and data protection in the digital age: a critical and and data protection in the digital age: a critical and forward-looking analysis of the GDPR and its imple- Kloza, D, Van Dijk, N, Gellert, R M, Borocz, I M, forward-looking analysis of the GDPR and its imple- Kloza, D, Van Dijk, N, Gellert, R M, Borocz, I M, mentation with respect to children and youth’ (Special Tanas, A, Mantovani, E, & Quinn, P, ‘Data protection mentation with respect to children and youth’ (Special Tanas, A, Mantovani, E, & Quinn, P, ‘Data protection Research Fund of Ghent University). impact assessments in the European Union: comple- Research Fund of Ghent University). impact assessments in the European Union: comple- menting the new legal framework towards a more menting the new legal framework towards a more robust protection of individuals: d.pia.lab’ (2017) robust protection of individuals: d.pia.lab’ (2017)

40 Communications Law Vol. 23, No. 1, 2018 40 Communications Law Vol. 23, No. 1, 2018 The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR

Policy Brief 1/2017: http://virthost.vub.ac.be/LSTS/ Schermer, B W, Custers, B, & van der Hof, S, ‘The Policy Brief 1/2017: http://virthost.vub.ac.be/LSTS/ Schermer, B W, Custers, B, & van der Hof, S, ‘The dpialab/images/dpialabcontent/dpialab_pb2017-1_ crisis of consent: How stronger legal protection may dpialab/images/dpialabcontent/dpialab_pb2017-1_ crisis of consent: How stronger legal protection may ﬁnal.pdf. lead to weaker consent in data protection’ (2014) ﬁnal.pdf. lead to weaker consent in data protection’ (2014) Ethics and Information Technology 16(2), 171–82. Ethics and Information Technology 16(2), 171–82. Lievens, E, & Verdoodt, V, ‘Looking for needles in a Lievens, E, & Verdoodt, V, ‘Looking for needles in a haystack: Key issues affecting children’s rights in the Shmueli, B, & Blecher-Prigat, A, ‘Privacy for Children’ haystack: Key issues affecting children’s rights in the Shmueli, B, & Blecher-Prigat, A, ‘Privacy for Children’ General Data Protection Regulation’ (2017) Computer (2014) Columbia Human Rights Law Review 42(3), General Data Protection Regulation’ (2017) Computer (2014) Columbia Human Rights Law Review 42(3), Law & Security Review: The International Journal of 759–95. Law & Security Review: The International Journal of 759–95. Technology Law and Practice. Technology Law and Practice. UN Committee on the Rights on the Child, ‘General UN Committee on the Rights on the Child, ‘General Lievens E, Livingstone, S, O’Neill, B, McLoughlin, S Comment No 14 on the right of the child to have his Lievens E, Livingstone, S, O’Neill, B, McLoughlin, S Comment No 14 on the right of the child to have his & Verdoodt, V, ‘Children’s rights and digital techno- or her best interests taken as a primary consideration & Verdoodt, V, ‘Children’s rights and digital techno- or her best interests taken as a primary consideration logies’ in Liefaard, T, & Kilkelly, U (eds) International (Art 3, para 1)’ (2013) CRC/C/GC/14. logies’ in Liefaard, T, & Kilkelly, U (eds) International (Art 3, para 1)’ (2013) CRC/C/GC/14. Human Rights. International Children’s Rights Law Human Rights. International Children’s Rights Law (Springer, 2018, forthcoming). Verdoodt V, & Lievens E, ‘Targeting Children with (Springer, 2018, forthcoming). Verdoodt V, & Lievens E, ‘Targeting Children with Personalised Advertising: How to Reconcile the Best Personalised Advertising: How to Reconcile the Best Montgomery KC, & Chester J, ‘Data Protection for Interests of Children and Advertisers’ in Vermeulen G Montgomery KC, & Chester J, ‘Data Protection for Interests of Children and Advertisers’ in Vermeulen G Youth in the Digital Age’ (2015) 1(4) European Data , & Lievens E (eds), Data Protection and Privacy Under Youth in the Digital Age’ (2015) 1(4) European Data , & Lievens E (eds), Data Protection and Privacy Under Protection Law Review 277. Pressure: Transatlantic tensions, EU surveillance, and Protection Law Review 277. Pressure: Transatlantic tensions, EU surveillance, and big data (Antwerpen, Maklu, 2017) 313-37. big data (Antwerpen, Maklu, 2017) 313-37. Narayanan, A, & Shmatikov, V, ‘De-anonymizing Narayanan, A, & Shmatikov, V, ‘De-anonymizing social networks’, in Proceedings - IEEE Symposium on Wachter, S, Mittelstadt, B, & Floridi, L, ‘Why a Right social networks’, in Proceedings - IEEE Symposium on Wachter, S, Mittelstadt, B, & Floridi, L, ‘Why a Right Security and Privacy (2009) 173-87. to Explanation of Automated Decision-Making Does Security and Privacy (2009) 173-87. to Explanation of Automated Decision-Making Does Not Exist in the General Data Protection Regulation’ Not Exist in the General Data Protection Regulation’ Ohm, P, ‘Broken Promises of Privacy: Responding to (2016) SSRN Electronic Journal. Ohm, P, ‘Broken Promises of Privacy: Responding to (2016) SSRN Electronic Journal. the Surprising Failure of Anonymization’ (2010) UCLA the Surprising Failure of Anonymization’ (2010) UCLA Law Review 57(6), 1701–777. Zuiderveen Borgesius, F J, ‘Singling out people Law Review 57(6), 1701–777. Zuiderveen Borgesius, F J, ‘Singling out people without knowing their names–behavioural targeting, without knowing their names–behavioural targeting, Pollach, I, ‘What’s wrong with online privacy pseudonymous data, and the new Data Protection Pollach, I, ‘What’s wrong with online privacy pseudonymous data, and the new Data Protection policies?’, Communications of the ACM, 50(9), (2007) Regulation’ (2016) Computer Law & Security Review, policies?’, Communications of the ACM, 50(9), (2007) Regulation’ (2016) Computer Law & Security Review, 103–108. https://doi.org/10.1145/1284621.1284627. 32, 256–71. 103–108. https://doi.org/10.1145/1284621.1284627. 32, 256–71.

Notes Notes

1 Article 24 of the Charter of Fundamental Rights of the European 3 The aim of this section is not to provide a full-blown analysis of Art 1 Article 24 of the Charter of Fundamental Rights of the European 3 The aim of this section is not to provide a full-blown analysis of Art Union also acknowledges the attribution of fundamental rights 8 GDPR, but rather to focus on the reasons why we think it is not Union also acknowledges the attribution of fundamental rights 8 GDPR, but rather to focus on the reasons why we think it is not to children: ‘1. Children shall have the right to such protection likely to protect children in ways the drafters of the GDPR had in to children: ‘1. Children shall have the right to such protection likely to protect children in ways the drafters of the GDPR had in and care as is necessary for their well-being. They may express mind. For a more thorough analysis of this provision, we refer to and care as is necessary for their well-being. They may express mind. For a more thorough analysis of this provision, we refer to their views freely. Such views shall be taken into consideration on Lievens & Verdoodt (2017) and Van der Hof (2017). their views freely. Such views shall be taken into consideration on Lievens & Verdoodt (2017) and Van der Hof (2017). matters which concern them in accordance with their age and 4 At least we are not aware of such evidence, nor does the GDPR matters which concern them in accordance with their age and 4 At least we are not aware of such evidence, nor does the GDPR maturity. 2. In all actions relating to children, whether taken by explain on what evidence it has based the ages it stipulates. maturity. 2. In all actions relating to children, whether taken by explain on what evidence it has based the ages it stipulates. public authorities or private institutions, the child’s best interests 5 See however the UK Data Protection Bill that sets the age at public authorities or private institutions, the child’s best interests 5 See however the UK Data Protection Bill that sets the age at must be a primary consideration. […]’. twelve years. must be a primary consideration. […]’. twelve years. 2 Article 8 GDPR reads as follows: 6 Supra n 4. 2 Article 8 GDPR reads as follows: 6 Supra n 4. (1) ‘Where point (a) of Article 6(1) applies, in relation to the offer 7 See further Schermer, Custers, Van der Hof (2014) and Van der (1) ‘Where point (a) of Article 6(1) applies, in relation to the offer 7 See further Schermer, Custers, Van der Hof (2014) and Van der of information society services directly to a child, the processing Hof (2017). of information society services directly to a child, the processing Hof (2017). of the personal data of a child shall be lawful where the child 8 See Arts 4(11) and 7 GDPR on (the conditions for) consent. of the personal data of a child shall be lawful where the child 8 See Arts 4(11) and 7 GDPR on (the conditions for) consent. is at least 16 years old. Where the child is below the age of 16 9 Pollach (2007). is at least 16 years old. Where the child is below the age of 16 9 Pollach (2007). years, such processing shall be lawful only if and to the extent that 10 J Koetsier, 40% of top-selling smartphone apps have no years, such processing shall be lawful only if and to the extent that 10 J Koetsier, 40% of top-selling smartphone apps have no consent is given or authorised by the holder of parental responsibi- privacy policy, Forbes (24 March 2016), https://www.forbes. consent is given or authorised by the holder of parental responsibi- privacy policy, Forbes (24 March 2016), https://www.forbes. lity over the child. Member States may provide by law for a lower com/forbes/welcome/?toURL=https://www.forbes.com/sites/ lity over the child. Member States may provide by law for a lower com/forbes/welcome/?toURL=https://www.forbes.com/sites/ age for those purposes provided that such lower age is not below johnkoetsier/2016/03/24/40-of-top-selling-smartphone-apps-have- age for those purposes provided that such lower age is not below johnkoetsier/2016/03/24/40-of-top-selling-smartphone-apps-have- 13 years. (2) The controller shall make reasonable efforts to verify no-privacy-policy/&refURL=&referrer=#. 13 years. (2) The controller shall make reasonable efforts to verify no-privacy-policy/&refURL=&referrer=#. in such cases that consent is given or authorised by the holder of 11 Under the UN CRC, children have a right to privacy pursuant to in such cases that consent is given or authorised by the holder of 11 Under the UN CRC, children have a right to privacy pursuant to parental responsibility over the child, taking into consideration article 16 and parents must adjust their guidance to the evolving parental responsibility over the child, taking into consideration article 16 and parents must adjust their guidance to the evolving available technology. (3) Paragraph 1 shall not affect the general capacities of their children (Art 5 UN CRC), which may entail that available technology. (3) Paragraph 1 shall not affect the general capacities of their children (Art 5 UN CRC), which may entail that contract law of Member States such as the rules on the validity, older children must be left a sufﬁcient amount of freedom and contract law of Member States such as the rules on the validity, older children must be left a sufﬁcient amount of freedom and formation or effect of a contract in relation to a child.’ independence from their parents or caregivers. formation or effect of a contract in relation to a child.’ independence from their parents or caregivers. 12 Shmueli, Blecher-Prigat (2011). 12 Shmueli, Blecher-Prigat (2011).

Communications Law Vol. 23, No. 1, 2018 41 Communications Law Vol. 23, No. 1, 2018 41 The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR

13 Through Google Family Link, parents can however add children GDPR). 13 Through Google Family Link, parents can however add children GDPR). to their own account to control their mobile phone use, https:// 32 This may potentially be seen as problematic – how to identify to their own account to control their mobile phone use, https:// 32 This may potentially be seen as problematic – how to identify families.google.com/familylink/faq/. children and in ways that observe the data minimisation principle families.google.com/familylink/faq/. children and in ways that observe the data minimisation principle 14 For instance, even quite straightforward commercial practices such – however we assume that methods exist or will be developed, 14 For instance, even quite straightforward commercial practices such – however we assume that methods exist or will be developed, as Google Ads are understood only by a minority of 12-15s; see preferably privacy-sensitive ones, to enable just that. as Google Ads are understood only by a minority of 12-15s; see preferably privacy-sensitive ones, to enable just that. Ofcom (2015). 33 See Hoepman (2012), Colesky et al (2016) for a more detailed Ofcom (2015). 33 See Hoepman (2012), Colesky et al (2016) for a more detailed 15 Van der Hof, Keymolen (2010). discussion of privacy by design strategies. 15 Van der Hof, Keymolen (2010). discussion of privacy by design strategies. 16 Hence, the reason why algorithmic accountability is an important 34 Strictly speaking the processing of a child’s personal data may still 16 Hence, the reason why algorithmic accountability is an important 34 Strictly speaking the processing of a child’s personal data may still topic to be explored and fleshed out in relation to the GDPR; be in compliance with data protection law, even if the subsequent topic to be explored and fleshed out in relation to the GDPR; be in compliance with data protection law, even if the subsequent see also Arts 12a, 13(2)f and 14(2)g GDPR. See on this topic, eg, of profiling is not; see the exact wording of Recital 71. see also Arts 12a, 13(2)f and 14(2)g GDPR. See on this topic, eg, of profiling is not; see the exact wording of Recital 71. Wachter, Mittelstadt, Floridi (2016). 35 See for exceptions Art 17(3) GDPR. Wachter, Mittelstadt, Floridi (2016). 35 See for exceptions Art 17(3) GDPR. 17 According to Art 4 (7) and (8) respectively ‘controller’ means the 36 The text reads as follows: ‘That right is relevant in particular where 17 According to Art 4 (7) and (8) respectively ‘controller’ means the 36 The text reads as follows: ‘That right is relevant in particular where natural or legal person, public authority, agency or other body the data subject has given his or her consent as a child and is not natural or legal person, public authority, agency or other body the data subject has given his or her consent as a child and is not which, alone or jointly with others, determines the purposes and fully aware of the risks involved by the processing, and later wants which, alone or jointly with others, determines the purposes and fully aware of the risks involved by the processing, and later wants means of the processing of personal data; where the purposes and to remove such personal data, especially on the internet. The data means of the processing of personal data; where the purposes and to remove such personal data, especially on the internet. The data means of such processing are determined by Union or Member subject should be able to exercise that right notwithstanding the means of such processing are determined by Union or Member subject should be able to exercise that right notwithstanding the State law, the controller or the specific criteria for its nomina- fact that he or she is no longer a child.’ State law, the controller or the specific criteria for its nomina- fact that he or she is no longer a child.’ tion may be provided for by Union or Member State law; and 37 As more fundamentally embodied in the right to informational tion may be provided for by Union or Member State law; and 37 As more fundamentally embodied in the right to informational ‘processor’ means a natural or legal person, public authority, self-determination which although not explicitly recognised in ‘processor’ means a natural or legal person, public authority, self-determination which although not explicitly recognised in agency or other body which processes personal data on behalf of the GDPR nonetheless heavily influences European data protec- agency or other body which processes personal data on behalf of the GDPR nonetheless heavily influences European data protec- the controller. tion law; see on this right Bundesverfassungsgericht [BVerfG] the controller. tion law; see on this right Bundesverfassungsgericht [BVerfG] 18 The foundation for our reasoning is the UN Convention on the [Federal Constitutional Court] December 15, 1983, 65 BVerfGE 18 The foundation for our reasoning is the UN Convention on the [Federal Constitutional Court] December 15, 1983, 65 BVerfGE Rights of the Child 1989 (UNCRC), which recognises children 1, 2008 (Ger) (Population Census case) in which the German Rights of the Child 1989 (UNCRC), which recognises children 1, 2008 (Ger) (Population Census case) in which the German as holders of fundamental rights rather than mere objects of Constitutional Court recognised the right to informational self- as holders of fundamental rights rather than mere objects of Constitutional Court recognised the right to informational self- protection. The best interest of the child entails that ‘in all actions determination as a part of a general personal right. protection. The best interest of the child entails that ‘in all actions determination as a part of a general personal right. concerning children […] the best interests of the child shall be the 38 See Bunn (2015); the clean slate notion is recognised in other concerning children […] the best interests of the child shall be the 38 See Bunn (2015); the clean slate notion is recognised in other primary consideration’ (Art 3 UNCRC, authors’ emphasis). legal areas, most notably criminal law, as well. primary consideration’ (Art 3 UNCRC, authors’ emphasis). legal areas, most notably criminal law, as well. 19 As acknowledged by the UK Information Commissioner’s 39 PIAC, Public Interest Advocacy Centre (PIAC) Submission to the 19 As acknowledged by the UK Information Commissioner’s 39 PIAC, Public Interest Advocacy Centre (PIAC) Submission to the Office draft ‘Children and the GDPR guidance’, Information Government Consultation on A Digital Economy Strategy for Office draft ‘Children and the GDPR guidance’, Information Government Consultation on A Digital Economy Strategy for Commissioner’s Office (2017), Children and the GDPR guidance, Canada, 2010, https://corporationscanada.ic.gc.ca/eic/site/028.nsf/ Commissioner’s Office (2017), Children and the GDPR guidance, Canada, 2010, https://corporationscanada.ic.gc.ca/eic/site/028.nsf/ https://ico.org.uk/media/about-the-ico/consultations/2172913/ eng/00217.html#p3.2.3. https://ico.org.uk/media/about-the-ico/consultations/2172913/ eng/00217.html#p3.2.3. children-and-the-gdpr-consultation-guidance-20171221.pdf. 40 See also Recital 65 GDPR. children-and-the-gdpr-consultation-guidance-20171221.pdf. 40 See also Recital 65 GDPR. 20 See Zuiderveen Borgesius (2016). On de-anonymisation see Ohm 41 Recital 91 GDPR. 20 See Zuiderveen Borgesius (2016). On de-anonymisation see Ohm 41 Recital 91 GDPR. (2009) and Narayanan, Shmatikov (2009). 42 Article 29 Data Protection Working Party (2017) Guidelines (2009) and Narayanan, Shmatikov (2009). 42 Article 29 Data Protection Working Party (2017) Guidelines 21 The extent of which is still unclear given the lack of evidence (see on Data Protection Impact Assessment (DPIA) and determi- 21 The extent of which is still unclear given the lack of evidence (see on Data Protection Impact Assessment (DPIA) and determi- section 2). ning whether processing is ‘likely to result in a high risk’ for the section 2). ning whether processing is ‘likely to result in a high risk’ for the 22 Available at https://www.coe.int/en/web/children/-/call-for-consul- purposes of Reg 2016/679, 17/EN WP 248, http://ec.europa.eu/ 22 Available at https://www.coe.int/en/web/children/-/call-for-consul- purposes of Reg 2016/679, 17/EN WP 248, http://ec.europa.eu/ tation-guidelines-for-member-states-to-promote-protect-and-fulfil- newsroom/just/item-detail.cfm?item_id=50083, p 4. tation-guidelines-for-member-states-to-promote-protect-and-fulfil- newsroom/just/item-detail.cfm?item_id=50083, p 4. children-s-rights-in-the-digital-environment?inheritRedirect=true 43 Unlike, for instance, in the case of ‘(a) a systematic and exten- children-s-rights-in-the-digital-environment?inheritRedirect=true 43 Unlike, for instance, in the case of ‘(a) a systematic and exten- (last visited 1 November 2017). sive evaluation of personal aspects relating to natural persons (last visited 1 November 2017). sive evaluation of personal aspects relating to natural persons 23 Supra n 18. which is based on automated processing, including profiling, and 23 Supra n 18. which is based on automated processing, including profiling, and 24 In an earlier draft of the GDPR this definition was explicitly on which decisions are based that produce legal effects concer- 24 In an earlier draft of the GDPR this definition was explicitly on which decisions are based that produce legal effects concer- included, yet removed later for reasons unknown to us. ning the natural person or similarly significantly affect the natural included, yet removed later for reasons unknown to us. ning the natural person or similarly significantly affect the natural 25 Although Art 25 only mentions controllers, seemingly the person; (b) processing on a large scale of special categories of data 25 Although Art 25 only mentions controllers, seemingly the person; (b) processing on a large scale of special categories of data GDPR also imposes responsibly ‘downstream’ to processors and referred to in Article 9(1), or of personal data relating to criminal GDPR also imposes responsibly ‘downstream’ to processors and referred to in Article 9(1), or of personal data relating to criminal ‘upstream’ to technology developers’, see Bygrave (2017), p 116. convictions and offences referred to in Article 10; or (c) a syste- ‘upstream’ to technology developers’, see Bygrave (2017), p 116. convictions and offences referred to in Article 10; or (c) a syste- 26 See also Recital 58. Article 40(2)(g) GDPR mentions the principle matic monitoring of a publicly accessible area on a large scale’ 26 See also Recital 58. Article 40(2)(g) GDPR mentions the principle matic monitoring of a publicly accessible area on a large scale’ of transparency in relation to children also as a matter that may be (Art 35 GDPR). The Article 29 Working Party notes that this is a of transparency in relation to children also as a matter that may be (Art 35 GDPR). The Article 29 Working Party notes that this is a regulated as part of codes of conduct of controllers. non-exhaustive list, see Article 29 Data Protection Working Party regulated as part of codes of conduct of controllers. non-exhaustive list, see Article 29 Data Protection Working Party 27 Given the complexity of data processing icons seem too simple a ‘Guidelines on Data Protection Impact Assessment’. 27 Given the complexity of data processing icons seem too simple a ‘Guidelines on Data Protection Impact Assessment’. way of conveying relevant information to data subjects, see eg Van 44 Note, however, that in Recital 75 in relation to the responsibility way of conveying relevant information to data subjects, see eg Van 44 Note, however, that in Recital 75 in relation to the responsibility den berg, Van der Hof, 2012 with references to other literature. of the controller processing of ‘personal data of vulnerable natural den berg, Van der Hof, 2012 with references to other literature. of the controller processing of ‘personal data of vulnerable natural Nonetheless, transparency solutions that encompass an element of persons, in particular of children’ is considered a potential ‘risk to Nonetheless, transparency solutions that encompass an element of persons, in particular of children’ is considered a potential ‘risk to visualisation should not be disregarded as helpful in this regard. the rights and freedoms of natural persons’. visualisation should not be disregarded as helpful in this regard. the rights and freedoms of natural persons’. 28 Although focused primarily on parents, Art 5 UNCRC recognises 45 Article 29 Data Protection Working Party, Guidelines on Data 28 Although focused primarily on parents, Art 5 UNCRC recognises 45 Article 29 Data Protection Working Party, Guidelines on Data that giving guidance and direction to children is dependent on Protection Impact Assessment, p 10. that giving guidance and direction to children is dependent on Protection Impact Assessment, p 10. their evolving capacities. 46 Information Commissioner’s Office, Children and the GDPR their evolving capacities. 46 Information Commissioner’s Office, Children and the GDPR 29 See further on the development perspective under children’s rights guidance (2017), n 19. 29 See further on the development perspective under children’s rights guidance (2017), n 19. law, Van der Hof, 2017. 47 General UN Committee on the Rights of the Child, ‘General law, Van der Hof, 2017. 47 General UN Committee on the Rights of the Child, ‘General 30 For the purpose of our argumentation here, we will assume that Comment No 5 (2003) General Measures of Implementation of 30 For the purpose of our argumentation here, we will assume that Comment No 5 (2003) General Measures of Implementation of the exceptions to this right pursuant to in Art 22(2) GDPR do not the Convention on the Rights of the Child (Arts 4, 42 and 44, para the exceptions to this right pursuant to in Art 22(2) GDPR do not the Convention on the Rights of the Child (Arts 4, 42 and 44, para apply. 6)’ (2003). apply. 6)’ (2003). 31 ‘Profiling’ means ‘any form of automated processing of personal 48 Ibid. 31 ‘Profiling’ means ‘any form of automated processing of personal 48 Ibid. data consisting of the use of personal data to evaluate certain 49 Verdoodt, Lievens (2017). data consisting of the use of personal data to evaluate certain 49 Verdoodt, Lievens (2017). personal aspects relating to a natural person, in particular to 50 See: https://www.unicef.org/csr/css/Children_s_Rights_in_Impact_ personal aspects relating to a natural person, in particular to 50 See: https://www.unicef.org/csr/css/Children_s_Rights_in_Impact_ analyse or predict aspects concerning that natural person’s perfor- Assessments_Web_161213.pdf. Also, for another proposal for analyse or predict aspects concerning that natural person’s perfor- Assessments_Web_161213.pdf. Also, for another proposal for mance at work, economic situation, health, personal preferences, child specific privacy impact assessments: Milda Macenaite, mance at work, economic situation, health, personal preferences, child specific privacy impact assessments: Milda Macenaite, interests, reliability, behaviour, location or movements’ (Art 4(4) Daniel Le Métayer, and Sourya Joyee De, Constructing Child interests, reliability, behaviour, location or movements’ (Art 4(4) Daniel Le Métayer, and Sourya Joyee De, Constructing Child

42 Communications Law Vol. 23, No. 1, 2018 42 Communications Law Vol. 23, No. 1, 2018 The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR The importance of privacy by design and data protection impact assessments in strengthening protection of children’s personal data under the GDPR

Specific Privacy Impact Assessments, forthcoming. 56 Article 29 Data Protection Working Party, ‘Guidelines on Data Specific Privacy Impact Assessments, forthcoming. 56 Article 29 Data Protection Working Party, ‘Guidelines on Data 51 UN Committee on the Rights on the Child, General Comment No Protection Impact Assessment’, p 13. 51 UN Committee on the Rights on the Child, General Comment No Protection Impact Assessment’, p 13. 14 on the right of the child to have his or her best interests taken 57 Article 29 Data Protection Working Party ,’Guidelines on Data 14 on the right of the child to have his or her best interests taken 57 Article 29 Data Protection Working Party ,’Guidelines on Data as a primary consideration (2013) (Art 3, para 1). CRC/C/GC/14. Protection Impact Assessment’ (DPIA), p17. Also Kloza, Van Dijk, as a primary consideration (2013) (Art 3, para 1). CRC/C/GC/14. Protection Impact Assessment’ (DPIA), p17. Also Kloza, Van Dijk, 52 Ibid. Gellert, Borocz, Tamas, Mantovani, Quinn (2017), p 2. 52 Ibid. Gellert, Borocz, Tamas, Mantovani, Quinn (2017), p 2. 53 Montgomery, Chester, (2015). 58 Ibid. 53 Montgomery, Chester, (2015). 58 Ibid. 54 Ibid. 59 Verdoodt, Lievens E, (2017). 54 Ibid. 59 Verdoodt, Lievens E, (2017). 55 Information Commissioner’s Office (2017). 55 Information Commissioner’s Office (2017).

Communications Law Vol. 23, No. 1, 2018 43 Communications Law Vol. 23, No. 1, 2018 43 The transparency challenge: making children aware of their data protection rights and the risks online The transparency challenge: making children aware of their data protection rights and the risks online

The transparency challenge: The transparency challenge: making children aware of their making children aware of their data protection rights and the data protection rights and the risks online1 risks online1

Anna Morgan Anna Morgan

Lifting the veil of invisibility Children merit specific protection with regard to their Lifting the veil of invisibility Children merit specific protection with regard to their personal data as they may be less aware of the risks, personal data as they may be less aware of the risks, It is timely to focus on children as key stakehol- consequences and safeguards concerned and their It is timely to focus on children as key stakehol- consequences and safeguards concerned and their ders in the digital ecosystem as we look towards 25 rights in relation to the processing of personal data. ders in the digital ecosystem as we look towards 25 rights in relation to the processing of personal data. May 2018 and the application of the General Data May 2018 and the application of the General Data Protection Regulation2 (GDPR) across Europe. Post Central to that core issue of understandability and Protection Regulation2 (GDPR) across Europe. Post Central to that core issue of understandability and 25 May 2018, for the first time there will be a data awareness is the obligation of transparency upon data 25 May 2018, for the first time there will be a data awareness is the obligation of transparency upon data protection law at EU level which lifts the veil of invisi- controllers under the GDPR. protection law at EU level which lifts the veil of invisi- controllers under the GDPR. bility that some would say has hitherto shrouded bility that some would say has hitherto shrouded child users of online and digital services. As recent child users of online and digital services. As recent academic research has highlighted, an estimated one Transparency – a reconstructed academic research has highlighted, an estimated one Transparency – a reconstructed third of internet users across the globe are under 18s.3 and recalibrated obligation third of internet users across the globe are under 18s.3 and recalibrated obligation However, as child safety organisations such as the Irish However, as child safety organisations such as the Irish Society for the Prevention of Cruelty to Children have Transparency under the GDPR7 is not so much a Society for the Prevention of Cruelty to Children have Transparency under the GDPR7 is not so much a pointed out4, these internet users are often operating brand new concept in the data protection regulatory pointed out4, these internet users are often operating brand new concept in the data protection regulatory in a world that was not originally designed with them regime as a reconstructed and recalibrated obliga- in a world that was not originally designed with them regime as a reconstructed and recalibrated obliga- in mind and still fails to recognise them as key players. tion, albeit one that has now been very much shunted in mind and still fails to recognise them as key players. tion, albeit one that has now been very much shunted centre stage. Anyone who has ever ‘gone online’ will centre stage. Anyone who has ever ‘gone online’ will However, from 25 May 2018, children are very be familiar with the concept of privacy policies or However, from 25 May 2018, children are very be familiar with the concept of privacy policies or much at the front and centre of the data protection privacy statements on websites which data controllers much at the front and centre of the data protection privacy statements on websites which data controllers landscape in Europe. The GDPR attributes special are required to provide as part of the obligation of fair landscape in Europe. The GDPR attributes special are required to provide as part of the obligation of fair protection to children and so it will shine an unremit- processing of personal data under the current EU law, protection to children and so it will shine an unremit- processing of personal data under the current EU law, ting spotlight upon data controllers in relation to the 1995 Data Protection Directive.8 That obligation ting spotlight upon data controllers in relation to the 1995 Data Protection Directive.8 That obligation safeguarding child users of online services. Effective of fair processing requires certain minimum informa- safeguarding child users of online services. Effective of fair processing requires certain minimum informa- protection of children in the labyrinthine online and tion to be provided to data subjects, including the fact protection of children in the labyrinthine online and tion to be provided to data subjects, including the fact digital environments will involve enabling children to of their data being processed, why that processing is digital environments will involve enabling children to of their data being processed, why that processing is exercise their legal and fundamental rights5 in a way happening and who the data controller is. However, exercise their legal and fundamental rights5 in a way happening and who the data controller is. However, that minimises the risks to them. This in turn means there has been an enduring apprehension about that minimises the risks to them. This in turn means there has been an enduring apprehension about maximising children’s understanding of the cyber- the utility of that limited information and whether maximising children’s understanding of the cyber- the utility of that limited information and whether terrain they inhabit as a large part of their everyday it truly enables data subjects to take control of their terrain they inhabit as a large part of their everyday it truly enables data subjects to take control of their lives. As Recital 386 of the GDPR states: personal data. Such apprehension is particularly perti- lives. As Recital 386 of the GDPR states: personal data. Such apprehension is particularly perti- nent in an online context given that privacy policies nent in an online context given that privacy policies

44 Communications Law Vol. 23, No. 1, 2018 44 Communications Law Vol. 23, No. 1, 2018 The transparency challenge: making children aware of their data protection rights and the risks online The transparency challenge: making children aware of their data protection rights and the risks online and statements have traditionally been expressed in the GDPR seeks to address. The core transparency and statements have traditionally been expressed in the GDPR seeks to address. The core transparency lengthy legalistic and specialist terms which can be obligation is found in Article 1214 of the GDPR, with lengthy legalistic and specialist terms which can be obligation is found in Article 1214 of the GDPR, with difficult for the average adult user to understand, let Article 12.1 requiring data controllers to take appro- difficult for the average adult user to understand, let Article 12.1 requiring data controllers to take appro- alone comprehensible by child users.9 priate measures to provide the required informa- alone comprehensible by child users.9 priate measures to provide the required information, related to processing of personal data, to data tion, related to processing of personal data, to data subjects in a concise, transparent, intelligible and subjects in a concise, transparent, intelligible and Regulatory disquietude easily accessible form, using clear and plain language. Regulatory disquietude easily accessible form, using clear and plain language. The specific information that must be provided by The specific information that must be provided by The online world with all its permutations is clearly the data controller to a data subject is now exten- The online world with all its permutations is clearly the data controller to a data subject is now exten- an intrinsic part of children’s everyday lives, and it sive (in comparison with the equivalent information an intrinsic part of children’s everyday lives, and it sive (in comparison with the equivalent information seems that the age at which children start regularly requirements applicable under Articles 10 and 1115 of seems that the age at which children start regularly requirements applicable under Articles 10 and 1115 of accessing the web is becoming lower and lower. the 1995 Data Protection Directive) and is set out in accessing the web is becoming lower and lower. the 1995 Data Protection Directive) and is set out in According to Ofcom10 in a report published in 2016, Articles 1316 and 1417. It includes information about According to Ofcom10 in a report published in 2016, Articles 1316 and 1417. It includes information about based on parents’ estimates 3-4 year olds are now who the data controller is, how the personal data will based on parents’ estimates 3-4 year olds are now who the data controller is, how the personal data will spending an average of 8 hours and 18 minutes per be used, who it will be shared with, whether it will spending an average of 8 hours and 18 minutes per be used, who it will be shared with, whether it will week online. Arguably, 21st century children’s use of be transferred internationally, the period for which week online. Arguably, 21st century children’s use of be transferred internationally, the period for which online services is effectively ubiquitous, with many it will be stored, and very importantly, what the data online services is effectively ubiquitous, with many it will be stored, and very importantly, what the data children now more digitally literate than their parents subject’s rights are – for example, the right to access, children now more digitally literate than their parents subject’s rights are – for example, the right to access, – sharing photos and videos, sending messages, using rectification, and erasure of personal data and to – sharing photos and videos, sending messages, using rectification, and erasure of personal data and to social media platforms, playing games and accessing make a complaint with a data protection authority. social media platforms, playing games and accessing make a complaint with a data protection authority. entertainment amongst other activities. The issue of Insofar as providing information to and communi- entertainment amongst other activities. The issue of Insofar as providing information to and communi- transparency in services targeted at children has long cating with children is concerned, it is hugely signi- transparency in services targeted at children has long cating with children is concerned, it is hugely signi- been a topic of global concern in the data protec- ficant that Article 12.1 of the GDPR carves out an been a topic of global concern in the data protec- ficant that Article 12.1 of the GDPR carves out an tion sphere. The International Conference of Data explicit transparency obligation on data controllers tion sphere. The International Conference of Data explicit transparency obligation on data controllers Protection and Privacy Commissioners has issued a for any information which is ‘addressed specifically to Protection and Privacy Commissioners has issued a for any information which is ‘addressed specifically to number of resolutions11 in recent years addressing a child’.18 This ties in with Recital 5819 of the GDPR, number of resolutions11 in recent years addressing a child’.18 This ties in with Recital 5819 of the GDPR, children’s online privacy and the need for educa- which makes it clear that because children merit children’s online privacy and the need for educa- which makes it clear that because children merit tional initiatives, and ventilating disquietude about specific protection, any information and communi- tional initiatives, and ventilating disquietude about specific protection, any information and communi- the online encroachment into the private lives of cation concerning the processing of a child’s data the online encroachment into the private lives of cation concerning the processing of a child’s data children and the fact that children are often unaware ‘should be in such a clear and plain language that the children and the fact that children are often unaware ‘should be in such a clear and plain language that the that their information, habits and behaviour are child can easily understand’. that their information, habits and behaviour are child can easily understand’. being tracked online. Such regulatory anxiety was being tracked online. Such regulatory anxiety was arguably validated by the results of the Global Privacy arguably validated by the results of the Global Privacy Enforcement Network Privacy Sweep of 201512 which Appropriate measures to Enforcement Network Privacy Sweep of 201512 which Appropriate measures to saw 29 data protection regulators around the world, achieve transparency saw 29 data protection regulators around the world, achieve transparency including the Irish Data Protection Commissioner and including the Irish Data Protection Commissioner and the Information Commissioner’s Office in the UK, So, what does this new GDPR transparency obliga- the Information Commissioner’s Office in the UK, So, what does this new GDPR transparency obliga- examine a total of 1,494 websites and apps which tion mean in practical terms for data controllers, such examine a total of 1,494 websites and apps which tion mean in practical terms for data controllers, such were targeted at, or popular amongst, children. The as the tech giants that run the social media, gaming, were targeted at, or popular amongst, children. The as the tech giants that run the social media, gaming, results raised concerns particularly around the volume messaging and photo-sharing websites and apps that results raised concerns particularly around the volume messaging and photo-sharing websites and apps that of children’s personal information that was collected are so popular with children? The answer to this is of children’s personal information that was collected are so popular with children? The answer to this is by those websites and apps, and later shared with bound up in one of the most important phrases in by those websites and apps, and later shared with bound up in one of the most important phrases in third parties. Among its findings, the study revealed Article 12, namely the requirement in Article 12.120 third parties. Among its findings, the study revealed Article 12, namely the requirement in Article 12.120 that while 67 per cent of the sites and apps examined that data controllers take ‘appropriate measures’ to that while 67 per cent of the sites and apps examined that data controllers take ‘appropriate measures’ to collected children’s personal data, only 22 per cent provide the required information to data subjects in collected children’s personal data, only 22 per cent provide the required information to data subjects in tailored their data protection communications to a concise, transparent, intelligible and easily acces- tailored their data protection communications to a concise, transparent, intelligible and easily acces- children. sible form. According to Article 12.1, such informa- children. sible form. According to Article 12.1, such information is to be provided in writing, or by other means, tion is to be provided in writing, or by other means, including where appropriate, by electronic means. including where appropriate, by electronic means. ‘Children merit specific However, the term ‘appropriate measures’ clearly ‘Children merit specific However, the term ‘appropriate measures’ clearly protection’13 does not provide a fixed benchmark for all data protection’13 does not provide a fixed benchmark for all data controllers. Instead, it denotes an inherent variability controllers. Instead, it denotes an inherent variability The understandability gap in information that data depending on the circumstances in which the data The understandability gap in information that data depending on the circumstances in which the data controllers must provide to individuals, particularly controller is processing personal data. Fundamental to controllers must provide to individuals, particularly controller is processing personal data. Fundamental to where those individuals are children, is what the a data controller’s ability to comply with the obliga- where those individuals are children, is what the a data controller’s ability to comply with the obliga- newly enunciated transparency obligation under tion to take ‘appropriate measures’ to convey the newly enunciated transparency obligation under tion to take ‘appropriate measures’ to convey the

Communications Law Vol. 23, No. 1, 2018 45 Communications Law Vol. 23, No. 1, 2018 45 The transparency challenge: making children aware of their data protection rights and the risks online The transparency challenge: making children aware of their data protection rights and the risks online

necessary information to a data subject is that the perhaps the biggest transparency challenge is getting necessary information to a data subject is that the perhaps the biggest transparency challenge is getting data controller must first know their audience and children to want to understand how and why their data controller must first know their audience and children to want to understand how and why their then tailor the communication of the information personal data is used and processed. That challenge then tailor the communication of the information personal data is used and processed. That challenge to data subjects in a way that is appropriate to that has to be embraced not only by data controllers but to data subjects in a way that is appropriate to that has to be embraced not only by data controllers but audience. Therefore, if a data controller knows (as it also by data protection authorities, policy makers, audience. Therefore, if a data controller knows (as it also by data protection authorities, policy makers, should do) that its audience consists of, or includes, educators, and parents who all have vital roles to should do) that its audience consists of, or includes, educators, and parents who all have vital roles to child users, then it should tailor its privacy information play when it comes to educating children and young child users, then it should tailor its privacy information play when it comes to educating children and young and communications so that child users can readily people about their rights and risks online. The UK and communications so that child users can readily people about their rights and risks online. The UK understand what is happening to their personal data Children’s Commissioner, in the ‘Growing Up Digital’ understand what is happening to their personal data Children’s Commissioner, in the ‘Growing Up Digital’ and what their rights are. This necessitates the data taskforce report22 in January 2017, called for the and what their rights are. This necessitates the data taskforce report22 in January 2017, called for the controller assessing what the most effective modality creation of a digital citizenship programme to be controller assessing what the most effective modality creation of a digital citizenship programme to be will be for conveying the information required under compulsory in every school from the age of 4 to 14. will be for conveying the information required under compulsory in every school from the age of 4 to 14. Articles 13 and 14 of the GDPR. Such an assessment Similar sentiments were echoed recently in submis- Articles 13 and 14 of the GDPR. Such an assessment Similar sentiments were echoed recently in submis- may include a consideration of the content and acces- sions23 made to an Irish Parliamentary Committee on may include a consideration of the content and acces- sions23 made to an Irish Parliamentary Committee on sibility of written statements, as well as the poten- Children and Youth Affairs in the context of its exami- sibility of written statements, as well as the poten- Children and Youth Affairs in the context of its exami- tial use of more visually based techniques such as nation of cyber security for children and young adults. tial use of more visually based techniques such as nation of cyber security for children and young adults. cartoons, pictograms, infograms and videos. It should Indeed, digital literacy is already a focus of many cartoons, pictograms, infograms and videos. It should Indeed, digital literacy is already a focus of many also involve an evaluation of the appropriateness of educational programmes but in addition to taking also involve an evaluation of the appropriateness of educational programmes but in addition to taking electronic tools such as layered information notices, account of the more high profile risks around issues electronic tools such as layered information notices, account of the more high profile risks around issues pop-up notices, hover-over notices or voice alerts. Of like cyber bullying and general online harassment pop-up notices, hover-over notices or voice alerts. Of like cyber bullying and general online harassment course, central to such considerations is the type of which attract much attention, children also need to be course, central to such considerations is the type of which attract much attention, children also need to be device that is being used, and whether, for example, educated about the perhaps more oblique risks arising device that is being used, and whether, for example, educated about the perhaps more oblique risks arising the device is a tablet, mobile phone or an internet- from their personal data being collected in the digital the device is a tablet, mobile phone or an internet- from their personal data being collected in the digital of-things device (including so-called ‘smart’ toys). ecosystem.24 of-things device (including so-called ‘smart’ toys). ecosystem.24 Whatever the device, it is essential that the measures Whatever the device, it is essential that the measures chosen for conveying the information are appro- Awareness of the right to transparency in personal chosen for conveying the information are appro- Awareness of the right to transparency in personal priate to the device being used by the child. With data processing is growing, and societally it seems that priate to the device being used by the child. With data processing is growing, and societally it seems that written statements, the overriding requirement for there is movement in the right direction, particularly written statements, the overriding requirement for there is movement in the right direction, particularly clear and plain language means that privacy notices with the incoming GDPR obligations on transparency. clear and plain language means that privacy notices with the incoming GDPR obligations on transparency. that are addressed to child users, or users including However, arguably technology is currently winning that are addressed to child users, or users including However, arguably technology is currently winning children, must employ a vocabulary, tone and style the race over transparency in the privacy arena. There children, must employ a vocabulary, tone and style the race over transparency in the privacy arena. There of the language that is appropriate to and resonates is still a lot of catching up to do in fostering a culture of the language that is appropriate to and resonates is still a lot of catching up to do in fostering a culture with children. This necessarily means no ‘legalese’, no where children – and indeed adults – expect and seek with children. This necessarily means no ‘legalese’, no where children – and indeed adults – expect and seek technical terms, jargon or ambiguous phrases that are out transparent information from those organisations technical terms, jargon or ambiguous phrases that are out transparent information from those organisations devoid of any real meaning and may be particularly who collect, use and profit from personal data25 so devoid of any real meaning and may be particularly who collect, use and profit from personal data25 so difficult for children to understand. that children, and adults, can make smart, informed difficult for children to understand. that children, and adults, can make smart, informed choices about how, and when, and to what extent, choices about how, and when, and to what extent, they chose to share their most invaluable asset – their they chose to share their most invaluable asset – their The biggest transparency personal data. The biggest transparency personal data. challenge of all? challenge of all? Anna Morgan Anna Morgan However, the data protection transparency challenge The author is a solicitor and Deputy Commissioner However, the data protection transparency challenge The author is a solicitor and Deputy Commissioner is not simply about ensuring data controller organi- (Head of Legal) with the Data Protection is not simply about ensuring data controller organi- (Head of Legal) with the Data Protection sations provide information and communicate in Commissioner for Ireland. She is the lead rappor- sations provide information and communicate in Commissioner for Ireland. She is the lead rappor- ways that children can understand. Privacy educa- teur for the Article 29 Working Party Guidelines on ways that children can understand. Privacy educa- teur for the Article 29 Working Party Guidelines on tion is essential to encouraging an awareness amongst Transparency under the GDPR. tion is essential to encouraging an awareness amongst Transparency under the GDPR. children of what their personal data is, what their children of what their personal data is, what their rights are and what the risks are when they share their This document has been prepared by the author rights are and what the risks are when they share their This document has been prepared by the author information online or digitally.21 No matter how acces- solely for presentation and discussion purposes. information online or digitally.21 No matter how acces- solely for presentation and discussion purposes. sibly or appealingly privacy information is presented Its contents do not constitute legal advice and are sibly or appealingly privacy information is presented Its contents do not constitute legal advice and are on a website or an app used by children, if child users not intended to be relied upon by any party as on a website or an app used by children, if child users not intended to be relied upon by any party as do not appreciate the significance of what that infor- legal advice, nor should they be taken as represen- do not appreciate the significance of what that infor- legal advice, nor should they be taken as represen- mation is telling them, then the risk is that they will ting the position or views of the Data Protection mation is telling them, then the risk is that they will ting the position or views of the Data Protection swipe right past it without taking any notice of it. So Commissioner for Ireland on any matter. swipe right past it without taking any notice of it. So Commissioner for Ireland on any matter.

46 Communications Law Vol. 23, No. 1, 2018 46 Communications Law Vol. 23, No. 1, 2018 The transparency challenge: making children aware of their data protection rights and the risks online The transparency challenge: making children aware of their data protection rights and the risks online

Notes Notes

1 This paper was presented by the author at the Institute of data subject) and Art 11: Information where the data have not 1 This paper was presented by the author at the Institute of data subject) and Art 11: Information where the data have not Advanced Legal Studies Information Law and Policy Centre been obtained from the data subject. Advanced Legal Studies Information Law and Policy Centre been obtained from the data subject. Annual Conference 2017, the theme of which was ‘Children and 16 Article 13 of the GDPR: Information to be provided where Annual Conference 2017, the theme of which was ‘Children and 16 Article 13 of the GDPR: Information to be provided where Digital Rights: Regulating Freedoms and Safeguards’. personal data are collected from the data subject. Digital Rights: Regulating Freedoms and Safeguards’. personal data are collected from the data subject. 2 Regulation (EU) 2016/679 of the European Parliament and of the 17 Article 14 of the GDPR: Information to be provided where 2 Regulation (EU) 2016/679 of the European Parliament and of the 17 Article 14 of the GDPR: Information to be provided where Council of 27 April 2016 on the protection of natural persons personal data have not been obtained from the data subject. Council of 27 April 2016 on the protection of natural persons personal data have not been obtained from the data subject. with regard to the processing of personal data and on the free 18 Article 12.1 states: ‘The controller shall take appropriate with regard to the processing of personal data and on the free 18 Article 12.1 states: ‘The controller shall take appropriate movement of such data, and repealing Dir 95/46/EC (General measures to provide any information referred to in Arts 13 and movement of such data, and repealing Dir 95/46/EC (General measures to provide any information referred to in Arts 13 and Data Protection Regulation). 14 and any communication under Arts 15 to 22 and 34 relating Data Protection Regulation). 14 and any communication under Arts 15 to 22 and 34 relating 3 Sonia Livingstone, John Carr and Jasmina Byrne, ‘One in Three: to processing to the data subject in a concise, transparent, intel- 3 Sonia Livingstone, John Carr and Jasmina Byrne, ‘One in Three: to processing to the data subject in a concise, transparent, intel- Internet Governance and Children’s Rights’, Innocenti Discussion ligible and easily accessible form, using clear and plain language, Internet Governance and Children’s Rights’, Innocenti Discussion ligible and easily accessible form, using clear and plain language, Paper No 2016-01 (UNICEF Office of Research, Florence, 2016 ) in particular for any information addressed specifically to a child. Paper No 2016-01 (UNICEF Office of Research, Florence, 2016 ) in particular for any information addressed specifically to a child. 10. The information shall be provided in writing, or by other means, 10. The information shall be provided in writing, or by other means, 4 See, for example, the ISPCC leaflet ‘Cyber safety is the including, where appropriate, by electronic means. When 4 See, for example, the ISPCC leaflet ‘Cyber safety is the including, where appropriate, by electronic means. When child protection issue of our time’ tweeted by the ISPCC (@ requested by the data subject, the information may be provided child protection issue of our time’ tweeted by the ISPCC (@ requested by the data subject, the information may be provided ISPCCChildline) on 25 October 2017. orally, provided that the identity of the data subject is proven by ISPCCChildline) on 25 October 2017. orally, provided that the identity of the data subject is proven by 5 The right to Respect for Private and Family Life (Art 7) and the other means’ (emphasis added). 5 The right to Respect for Private and Family Life (Art 7) and the other means’ (emphasis added). right to Protection of Personal Data (Art 8) are fundamental rights 19 Recital 58 states: ‘The principle of transparency requires that right to Protection of Personal Data (Art 8) are fundamental rights 19 Recital 58 states: ‘The principle of transparency requires that under the Charter of Fundamental Rights of the European Union. any information addressed to the public or to the data subject under the Charter of Fundamental Rights of the European Union. any information addressed to the public or to the data subject 6 Recital 38 of the General Data Protection Regulation: ‘Children be concise, easily accessible and easy to understand, and that 6 Recital 38 of the General Data Protection Regulation: ‘Children be concise, easily accessible and easy to understand, and that merit specific protection with regard to their personal data, clear and plain language and, additionally, where appropriate, merit specific protection with regard to their personal data, clear and plain language and, additionally, where appropriate, as they may be less aware of the risks, consequences and visualisation be used. Such information could be provided in as they may be less aware of the risks, consequences and visualisation be used. Such information could be provided in safeguards concerned and their rights in relation to the proces- electronic form, for example, when addressed to the public, safeguards concerned and their rights in relation to the proces- electronic form, for example, when addressed to the public, sing of personal data. Such specific protection should, in through a website. This is of particular relevance in situa- sing of personal data. Such specific protection should, in through a website. This is of particular relevance in situa- particular, apply to the use of personal data of children for the tions where the proliferation of actors and the technological particular, apply to the use of personal data of children for the tions where the proliferation of actors and the technological purposes of marketing or creating personality or user profiles complexity of practice make it difficult for the data subject to purposes of marketing or creating personality or user profiles complexity of practice make it difficult for the data subject to and the collection of personal data with regard to children when know and understand whether, by whom and for what purpose and the collection of personal data with regard to children when know and understand whether, by whom and for what purpose using services offered directly to a child. The consent of the personal data relating to him or her are being collected, such using services offered directly to a child. The consent of the personal data relating to him or her are being collected, such holder of parental responsibility should not be necessary in the as in the case of online advertising. Given that children merit holder of parental responsibility should not be necessary in the as in the case of online advertising. Given that children merit context of preventive or counselling services offered directly to a specific protection, any information and communication, where context of preventive or counselling services offered directly to a specific protection, any information and communication, where child.’ processing is addressed to a child, should be in such a clear and child.’ processing is addressed to a child, should be in such a clear and 7 The Article 29 Working Party has published Guidelines on plain language that the child can easily understand.’ 7 The Article 29 Working Party has published Guidelines on plain language that the child can easily understand.’ Transparency under the GDPR, a final version of which will be 20 See n 18 above. Transparency under the GDPR, a final version of which will be 20 See n 18 above. issued following the conclusion of a public consultation (running 21 See, for example, the International Conference of Data issued following the conclusion of a public consultation (running 21 See, for example, the International Conference of Data until 23 January 2018) on the guidelines: http://ec.europa.eu/ Protection and Privacy Commissioners, ‘Personal Data Protection until 23 January 2018) on the guidelines: http://ec.europa.eu/ Protection and Privacy Commissioners, ‘Personal Data Protection newsroom/article29/news.cfm?item_type=1310&tpa_id=6936 Competency Framework for School Students’ (October 2016), newsroom/article29/news.cfm?item_type=1310&tpa_id=6936 Competency Framework for School Students’ (October 2016), 8 See Art 10 (Information in cases of collection of data from the p4: ‘In the digital age, responsible, ethical and civic-minded 8 See Art 10 (Information in cases of collection of data from the p4: ‘In the digital age, responsible, ethical and civic-minded data subject) of Dir 95/46/EC of the European Parliament and of education in the use of new technologies is a priority for data subject) of Dir 95/46/EC of the European Parliament and of education in the use of new technologies is a priority for the Council of 24 October 1995 on the protection of individuals action, particularly young people in school. A key compo- the Council of 24 October 1995 on the protection of individuals action, particularly young people in school. A key compo- with regard to the processing of personal data and on the free nent of digital education is highlighting privacy and personal with regard to the processing of personal data and on the free nent of digital education is highlighting privacy and personal movement of such data. data protection. Educators have a key role to play in this digital movement of such data. data protection. Educators have a key role to play in this digital 9 See, for example, the Article 29 Working Party Opinion 10/2004 education of citizens’: https://edps.europa.eu/sites/edp/files/ 9 See, for example, the Article 29 Working Party Opinion 10/2004 education of citizens’: https://edps.europa.eu/sites/edp/files/ on More Harmonised Information Provisions at p 5, para 4. publication/16-10-18_resolution-competency-framework_en.pdf. on More Harmonised Information Provisions at p 5, para 4. publication/16-10-18_resolution-competency-framework_en.pdf. 10 ‘Children and parents: media use and attitudes report’ (Ofcom, 22 Children’s Commissioner, ‘Growing Up Digital: A report of the 10 ‘Children and parents: media use and attitudes report’ (Ofcom, 22 Children’s Commissioner, ‘Growing Up Digital: A report of the 2016), p 47, fig 17. Growing Up Digital Taskforce ‘(January 2017), p3: https://www. 2016), p 47, fig 17. Growing Up Digital Taskforce ‘(January 2017), p3: https://www. 11 30th International Conference of Data Protection and Privacy childrenscommissioner.gov.uk/wp-content/uploads/2017/06/ 11 30th International Conference of Data Protection and Privacy childrenscommissioner.gov.uk/wp-content/uploads/2017/06/ Commissioners (2008, Strasbourg), ‘Resolution on Children’s Growing-Up-Digital-Taskforce-Report-January-2017_0.pdf Commissioners (2008, Strasbourg), ‘Resolution on Children’s Growing-Up-Digital-Taskforce-Report-January-2017_0.pdf Online Privacy’, 38th International Conference of Data Protection 23 Submissions to the Joint Oireachtas Committee on Children Online Privacy’, 38th International Conference of Data Protection 23 Submissions to the Joint Oireachtas Committee on Children and Privacy Commissioners (2016, Marrakesh), ‘Resolution for and Youth Affairs can be accessed under September 2017 and Privacy Commissioners (2016, Marrakesh), ‘Resolution for and Youth Affairs can be accessed under September 2017 the Adoption of an International Competency Framework on and October 2017 at: http://www.oireachtas.ie/parliament/ the Adoption of an International Competency Framework on and October 2017 at: http://www.oireachtas.ie/parliament/ Privacy Education’. oireachtasbusiness/committees_list/cya/presentations/ Privacy Education’. oireachtasbusiness/committees_list/cya/presentations/ 12 For more information on the results of the 2015 Global Privacy 24 As illustrated, for example, by dialogue with children recorded 12 For more information on the results of the 2015 Global Privacy 24 As illustrated, for example, by dialogue with children recorded Enforcement Network Privacy (GPEN) sweep, see the GPEN by the 5Rights movement at: http://5rightsframework.com/the-5- Enforcement Network Privacy (GPEN) sweep, see the GPEN by the 5Rights movement at: http://5rightsframework.com/the-5- 2015 Annual Report. https://www.privacyenforcement.net/sites/ rights/5rights-by-young-people.html 2015 Annual Report. https://www.privacyenforcement.net/sites/ rights/5rights-by-young-people.html default/files/Annual%20Report%20Final%20Version.pdf and also 25 See, for example, p 22 of the Better Internet For Kids default/files/Annual%20Report%20Final%20Version.pdf and also 25 See, for example, p 22 of the Better Internet For Kids https://www.dataprotection.ie/documents/GPen/GPEN2015.pdf Roundtable Report (June 2016) on ‘The General Data https://www.dataprotection.ie/documents/GPen/GPEN2015.pdf Roundtable Report (June 2016) on ‘The General Data 13 Recital 38. The principle is also referred to in Recital 58 of the Protection Regulation and children’s rights: questions and 13 Recital 38. The principle is also referred to in Recital 58 of the Protection Regulation and children’s rights: questions and GDPR, as considered further below. answers for legislators, DPAs, industry, education, stakehol- GDPR, as considered further below. answers for legislators, DPAs, industry, education, stakehol- 14 Article 12 of the GDPR: Transparent information, communi- ders and civil society’: https://www.betterinternetforkids.eu/ 14 Article 12 of the GDPR: Transparent information, communi- ders and civil society’: https://www.betterinternetforkids.eu/ cation and modalities for the exercise of the rights of the data documents/167024/2013511/GDPRRoundtable_June2017_ cation and modalities for the exercise of the rights of the data documents/167024/2013511/GDPRRoundtable_June2017_ subject. FullReport.pdf/e6998eb6-ba3c-4b5d-a2a6-145e2af594f2 subject. FullReport.pdf/e6998eb6-ba3c-4b5d-a2a6-145e2af594f2 15 Article 10: Information in cases of collection of data from the 15 Article 10: Information in cases of collection of data from the

Communications Law Vol. 23, No. 1, 2018 47 Communications Law Vol. 23, No. 1, 2018 47 Case Notes & Comments Case Notes & Comments

Case Notes & Comments Case Notes & Comments

New approach to media cases privacy injunction data have been insufficient, and New approach to media cases privacy injunction data have been insufficient, and at the Royal Courts of Justice also that the availability of information about media at the Royal Courts of Justice also that the availability of information about media is a welcome and refreshing cases could be improved more generally. is a welcome and refreshing cases could be improved more generally. development My own efforts to access case files and records in development My own efforts to access case files and records in 2011-13, to update research conducted by Eric 2011-13, to update research conducted by Eric In 2012 Mr Justice Tugendhat, ahead of his retire- Barendt and others in the mid 1990s, and to inter- In 2012 Mr Justice Tugendhat, ahead of his retire- Barendt and others in the mid 1990s, and to inter- ment in 2014, made a plea for more media specialist rogate assertions of defamation’s ‘chilling effect’, ment in 2014, made a plea for more media specialist rogate assertions of defamation’s ‘chilling effect’, barristers and solicitors to consider a judicial role: ‘As proved largely unsuccessful and I was astonished barristers and solicitors to consider a judicial role: ‘As proved largely unsuccessful and I was astonished the recruiting posters put it: Your country needs you.’ how rudimentary and paper-based internal systems the recruiting posters put it: Your country needs you.’ how rudimentary and paper-based internal systems He emphasised the particular burden of freedom of at the Royal Courts of Justice appeared to be. He emphasised the particular burden of freedom of at the Royal Courts of Justice appeared to be. expression cases, which require judges, for example, Although public observers are entitled to access expression cases, which require judges, for example, Although public observers are entitled to access to consider the rights of third parties, ‘even if those certain documents – such as claim forms – the cost to consider the rights of third parties, ‘even if those certain documents – such as claim forms – the cost third parties choose not to attend court’ and to and difficulty in locating claim numbers prohibits any third parties choose not to attend court’ and to and difficulty in locating claim numbers prohibits any provide reasons for the granting of injunctions at very kind of useful bulk research which would allow more provide reasons for the granting of injunctions at very kind of useful bulk research which would allow more short notice. Without expert knowledge of the appli- sophisticated qualitative and quantitative analysis of short notice. Without expert knowledge of the appli- sophisticated qualitative and quantitative analysis of cable law, this is no easy task. Fortunately, media law media litigation. I jumped, therefore, at the oppor- cable law, this is no easy task. Fortunately, media law media litigation. I jumped, therefore, at the oppor- cases have not fallen apart with the respective retire- tunity of the consultation to raise my concerns about cases have not fallen apart with the respective retire- tunity of the consultation to raise my concerns about ments of Sir Michael Tugendhat and Sir David Eady, the injunctions data, and to support the creation of ments of Sir Michael Tugendhat and Sir David Eady, the injunctions data, and to support the creation of and recent specialists to join the High Court include a new user group committee. My submission with and recent specialists to join the High Court include a new user group committee. My submission with Mr Justice Warby in 2014, and Mr Justice Nicklin in Paul Magrath and Julie Doughty, on behalf of the Mr Justice Warby in 2014, and Mr Justice Nicklin in Paul Magrath and Julie Doughty, on behalf of the 2017 – both formerly of 5RB chambers. Transparency Project charity, made suggestions for 2017 – both formerly of 5RB chambers. Transparency Project charity, made suggestions for revising the injunctions data collection process, inclu- revising the injunctions data collection process, inclu- The arrival of Warby J, who was given the newly ding the introduction of an audit procedure to check The arrival of Warby J, who was given the newly ding the introduction of an audit procedure to check created role of ‘Judge in charge of the Media and information was being recorded systematically and created role of ‘Judge in charge of the Media and information was being recorded systematically and Communications List’, has provided a welcome accurately. Communications List’, has provided a welcome accurately. opportunity to propose changes to the procedure of opportunity to propose changes to the procedure of media litigation in the Queen’s Bench Division, where Following the consultation, Warby J held a large media litigation in the Queen’s Bench Division, where Following the consultation, Warby J held a large the majority of English defamation and privacy claims meeting at the RCJ for all respondents and other the majority of English defamation and privacy claims meeting at the RCJ for all respondents and other are heard. Since taking on responsibility for the cases interested parties at which he shared a table of propo- are heard. Since taking on responsibility for the cases interested parties at which he shared a table of propo- involving one or more of the main media torts – inclu- sals from the consultation, provisionally ranked as involving one or more of the main media torts – inclu- sals from the consultation, provisionally ranked as ding defamation, misuse of private information and ‘most feasible’, ‘more difficult’ and ‘most difficult’. ding defamation, misuse of private information and ‘most feasible’, ‘more difficult’ and ‘most difficult’. breach of duty under the Data Protection 1998 – The last category also included proposals which breach of duty under the Data Protection 1998 – The last category also included proposals which Warby J has spoken about his hopes and plans for the would require primary legislation, which would be Warby J has spoken about his hopes and plans for the would require primary legislation, which would be list, and also conducted a consultation among those a matter for Parliament rather than the Judiciary. I list, and also conducted a consultation among those a matter for Parliament rather than the Judiciary. I who litigate in the area, as well as other interested was pleased that our initial proposals on the transpa- who litigate in the area, as well as other interested was pleased that our initial proposals on the transpa- parties. The consultation considered the adequacy rency of injunctions data have been deemed practical parties. The consultation considered the adequacy rency of injunctions data have been deemed practical of Civil Procedure Rules and Practice Directions; and feasible in the first instance. Also considered of Civil Procedure Rules and Practice Directions; and feasible in the first instance. Also considered the adequacy of the regime for monitoring statistics achievable are some of the proposals related to case the adequacy of the regime for monitoring statistics achievable are some of the proposals related to case on privacy injunctions; and support for the creation management and listings, updating the pre-action on privacy injunctions; and support for the creation management and listings, updating the pre-action of a new committee. As a socio-legal researcher protocol (PAP), the Queen’s Bench Guide, and civil of a new committee. As a socio-legal researcher protocol (PAP), the Queen’s Bench Guide, and civil rather than legal practitioner, my interest was piqued practice directions in light of developments in privacy, rather than legal practitioner, my interest was piqued practice directions in light of developments in privacy, by the latter two questions. For some time, I have data protection and defamation litigation and press by the latter two questions. For some time, I have data protection and defamation litigation and press been concerned that efforts by the Judiciary and the regulation (not least to reflect the Defamation Act been concerned that efforts by the Judiciary and the regulation (not least to reflect the Defamation Act Ministry of Justice to collect and publish anonymised 2013). Ministry of Justice to collect and publish anonymised 2013).

48 Communications Law Vol. 23, No. 1, 2018 48 Communications Law Vol. 23, No. 1, 2018 Case Notes & Comments Case Notes & Comments

This meeting also established the creation of a That said, a committee formed by the judiciary is This meeting also established the creation of a That said, a committee formed by the judiciary is new Media and Communications List User Group constrained in its remit, quite rightly. The conside- new Media and Communications List User Group constrained in its remit, quite rightly. The conside- (MACLUG) to which a range of representatives have ration of changes to primary legislation should fall (MACLUG) to which a range of representatives have ration of changes to primary legislation should fall been appointed. The group comprises members of to Parliament. It is therefore important that media been appointed. The group comprises members of to Parliament. It is therefore important that media the Bar and private practice solicitors (including both law practitioners and other stakeholders also work the Bar and private practice solicitors (including both law practitioners and other stakeholders also work claimant and defendant specialists), in-house counsel, with the Ministry of Justice and HMCTS to inform claimant and defendant specialists), in-house counsel, with the Ministry of Justice and HMCTS to inform clerks, and a costs practitioner. Additionally, I have ongoing work on courts modernisation, and push clerks, and a costs practitioner. Additionally, I have ongoing work on courts modernisation, and push joined as a representative of public interest groups for wider consultation and involvement in reforms. joined as a representative of public interest groups for wider consultation and involvement in reforms. – ie those engaged in academic research and third A further challenge is to persuade government and – ie those engaged in academic research and third A further challenge is to persuade government and sector work. The new committee met for the first parliamentarians to take on any issues requiring sector work. The new committee met for the first parliamentarians to take on any issues requiring time at the end of 2017, and members have formed changes to legislation. Part I of the Leveson Inquiry time at the end of 2017, and members have formed changes to legislation. Part I of the Leveson Inquiry smaller working groups to take forward the ‘feasible’ addressing, in part, the relationship between media smaller working groups to take forward the ‘feasible’ addressing, in part, the relationship between media proposals, which will be discussed with our respec- proprietors, editors and politicians showed that the proposals, which will be discussed with our respec- proprietors, editors and politicians showed that the tive constituencies in due course, and where relevant, process of consultation on public policy affecting the tive constituencies in due course, and where relevant, process of consultation on public policy affecting the eventually proposed to the Civil Procedure Rule news media has been subject to undue influence by eventually proposed to the Civil Procedure Rule news media has been subject to undue influence by Committee to consider. certain private interests and insufficiently transparent. Committee to consider. certain private interests and insufficiently transparent. To this end, perhaps the new Lord Chancellor and To this end, perhaps the new Lord Chancellor and In a speech to the Annual Conference of the Media Secretary of State for Justice, David Gauke MP, and In a speech to the Annual Conference of the Media Secretary of State for Justice, David Gauke MP, and Law Resource Center in September 2017 Warby J the new Secretary of State for Digital, Culture, Media Law Resource Center in September 2017 Warby J the new Secretary of State for Digital, Culture, Media identified his overall aims for the ‘big picture’ and and Sport, Matt Hancock MP, might consider ways identified his overall aims for the ‘big picture’ and and Sport, Matt Hancock MP, might consider ways landscape of media litigation: to resolve disputes fairly, in which they can consult more openly and fairly in landscape of media litigation: to resolve disputes fairly, in which they can consult more openly and fairly in promptly, and at reasonable cost. All of which were their development of policy and draft legislation on promptly, and at reasonable cost. All of which were their development of policy and draft legislation on ‘easier said than done’, in his words. Quite so. But it freedom of expression, reputation and privacy. ‘easier said than done’, in his words. Quite so. But it freedom of expression, reputation and privacy. is right that it should be attempted, and with judicial is right that it should be attempted, and with judicial input where appropriate. Warby J’s efforts to date are Dr Judith Townend input where appropriate. Warby J’s efforts to date are Dr Judith Townend to be applauded, and in particular, his open approach Lecturer in media and information law at the to be applauded, and in particular, his open approach Lecturer in media and information law at the in addressing some of the flaws and inconsistencies University of Sussex, and a member of the Queen’s in addressing some of the flaws and inconsistencies University of Sussex, and a member of the Queen’s of current practice, and evaluating structural and Bench Division Media and Communications List of current practice, and evaluating structural and Bench Division Media and Communications List systemic issues. User Group Committee systemic issues. User Group Committee

Communications Law Vol. 23, No. 1, 2018 49 Communications Law Vol. 23, No. 1, 2018 49 Recent Developments Recent Developments

Recent Developments Recent Developments

Forum non conveniens Convention or, as the case may be, the Lugano Forum non conveniens Convention or, as the case may be, the Lugano Convention or the 2005 Hague Convention. Convention or the 2005 Hague Convention. In Kennedy v National Trust for Scotland [2017] EWHC In Kennedy v National Trust for Scotland [2017] EWHC 3368 (QB) before Sir David Eady, the claimant, However, because the claimant complained of 3368 (QB) before Sir David Eady, the claimant, However, because the claimant complained of who was domiciled in Scotland, sought damages re-publication of the defamatory words in France who was domiciled in Scotland, sought damages re-publication of the defamatory words in France and other remedies in England against the National and Italy, he suggested that this was not ‘a purely and other remedies in England against the National and Italy, he suggested that this was not ‘a purely Trust for Scotland in respect of a number of allega- domestic case’. He argued that jurisdictional matters Trust for Scotland in respect of a number of allega- domestic case’. He argued that jurisdictional matters tions published in both jurisdictions as well as in Italy, were governed by the Brussels Recast Regulation tions published in both jurisdictions as well as in Italy, were governed by the Brussels Recast Regulation France and Brazil. He relied not only on defama- 2012/1215, which would take precedence over the France and Brazil. He relied not only on defama- 2012/1215, which would take precedence over the tion but also on negligence and on alleged breaches 1982 Act. Where that regulation applied, it followed tion but also on negligence and on alleged breaches 1982 Act. Where that regulation applied, it followed of the Data Protection Act 1998. The dispute arose from Owusu v Jackson (C-281/2002) [2005] QB 801 of the Data Protection Act 1998. The dispute arose from Owusu v Jackson (C-281/2002) [2005] QB 801 over the claimant’s attendance at Craigievar Castle and Maletic v lastminute.com GmbH (C-478-12) over the claimant’s attendance at Craigievar Castle and Maletic v lastminute.com GmbH (C-478-12) in Aberdeenshire, when he took a series of photo- [2014] QB 424 that the English court was deprived of in Aberdeenshire, when he took a series of photo- [2014] QB 424 that the English court was deprived of graphs of a naked model for commercial purposes. any discretion to stay on grounds of non conveniens. graphs of a naked model for commercial purposes. any discretion to stay on grounds of non conveniens. He claimed that he did so pursuant to an oral The court considered whether there was indeed an He claimed that he did so pursuant to an oral The court considered whether there was indeed an contract with a representative of the defendant, international element such as to take this case out contract with a representative of the defendant, international element such as to take this case out which expressly authorised that activity. This episode of the category of ‘domestic, and if so, and if the which expressly authorised that activity. This episode of the category of ‘domestic, and if so, and if the came to the attention of a National Trust donor who Recast Regulation did apply, considered whether its came to the attention of a National Trust donor who Recast Regulation did apply, considered whether its protested that the castle had been used for taking operation would override the rules of national law protested that the castle had been used for taking operation would override the rules of national law nude photographs. Her remarks caught the attention contained in Schedule 4 of the 1982 Act (including nude photographs. Her remarks caught the attention contained in Schedule 4 of the 1982 Act (including of a journalist who made enquiries and was given a the doctrine of forum non conveniens)? of a journalist who made enquiries and was given a the doctrine of forum non conveniens)? statement by or on behalf of the defendant which was statement by or on behalf of the defendant which was reported in the Scottish Mail on Sunday. The rule of general jurisdiction derived from Article reported in the Scottish Mail on Sunday. The rule of general jurisdiction derived from Article 4(1) provided that, subject to speciﬁc exceptions, a 4(1) provided that, subject to speciﬁc exceptions, a Thereafter, the defendant also issued a press release person domiciled in a Member State shall be sued Thereafter, the defendant also issued a press release person domiciled in a Member State shall be sued which denied that the taking of the photographs had in the courts of that Member State. The exceptions which denied that the taking of the photographs had in the courts of that Member State. The exceptions been authorised. This was sent to a number of media were contained in sections 2 to 7 of chapter II. There been authorised. This was sent to a number of media were contained in sections 2 to 7 of chapter II. There outlets. were, for example, the rules of special jurisdiction in outlets. were, for example, the rules of special jurisdiction in section 2 at Article 7. It was provided in Article 7(2) section 2 at Article 7. It was provided in Article 7(2) The defendant argued that jurisdiction should be that in matters relating to tort, delict or quasi-delict, The defendant argued that jurisdiction should be that in matters relating to tort, delict or quasi-delict, declined on the basis that Scotland would be the a person domiciled in a member state may be sued declined on the basis that Scotland would be the a person domiciled in a member state may be sued more appropriate forum. The claimant resisted this, in the courts for ‘the place where the harmful event more appropriate forum. The claimant resisted this, in the courts for ‘the place where the harmful event not only because the discretion would be exercised in occurred or may occur’. The purpose of the regula- not only because the discretion would be exercised in occurred or may occur’. The purpose of the regula- favour of England and a stay refused, but also because tion, and of the rule of general jurisdiction, was to favour of England and a stay refused, but also because tion, and of the rule of general jurisdiction, was to issues of forum conveniens were altogether precluded regularise issues of jurisdiction as between different issues of forum conveniens were altogether precluded regularise issues of jurisdiction as between different because this was not ‘a purely domestic case’. states. No such question arose here, because the because this was not ‘a purely domestic case’. states. No such question arose here, because the only potential competition was between the courts only potential competition was between the courts Section 49 of the Civil Jurisdiction and Judgments Act of Scotland and England & Wales (ie internal to the Section 49 of the Civil Jurisdiction and Judgments Act of Scotland and England & Wales (ie internal to the 1982 provided that: United Kingdom). 1982 provided that: United Kingdom).

Nothing in this Act shall prevent any court in the By contrast, in Owusu v Jackson and Maletic there was Nothing in this Act shall prevent any court in the By contrast, in Owusu v Jackson and Maletic there was United Kingdom from staying, sisting, striking out clearly an international element. In the present case, United Kingdom from staying, sisting, striking out clearly an international element. In the present case, or dismissing any proceedings before it, on the one defendant had been sued in the UK, where it was or dismissing any proceedings before it, on the one defendant had been sued in the UK, where it was ground of forum non conveniens or otherwise, to be treated as domiciled, and the fact that remedies ground of forum non conveniens or otherwise, to be treated as domiciled, and the fact that remedies where to do so is not inconsistent with the 1968 were sought against it in respect of re-publications in where to do so is not inconsistent with the 1968 were sought against it in respect of re-publications in

50 Communications Law Vol. 23, No. 1, 2018 50 Communications Law Vol. 23, No. 1, 2018 Recent Developments Recent Developments other jurisdictions did not entail any issue of compe- The court considered whether (1) the action should other jurisdictions did not entail any issue of compe- The court considered whether (1) the action should ting courts. It was thus not easy to see why the regula- be stayed under section 49 and (2) whether the ting courts. It was thus not easy to see why the regula- be stayed under section 49 and (2) whether the tion should be engaged. The competing claims would claims for global damages be struck out. There was tion should be engaged. The competing claims would claims for global damages be struck out. There was appear to be matters for internal determination by the no doubt that ‘substantial justice’ could be achieved appear to be matters for internal determination by the no doubt that ‘substantial justice’ could be achieved courts of the UK. The claimant pointed to a passage in in the courts of Scotland. The question was whether courts of the UK. The claimant pointed to a passage in in the courts of Scotland. The question was whether Briggs on Civil Jurisdiction and Judgments (6th edn) at Scotland was clearly more appropriate for resolving Briggs on Civil Jurisdiction and Judgments (6th edn) at Scotland was clearly more appropriate for resolving 2.28, cited in Cook v Virgin Media Ltd [2016] 1 WLR the issues in the interests of all the parties and the 2.28, cited in Cook v Virgin Media Ltd [2016] 1 WLR the issues in the interests of all the parties and the 1672 at [25]. There, a hypothetical illustration was ends of justice. That was initially for the defendant to 1672 at [25]. There, a hypothetical illustration was ends of justice. That was initially for the defendant to discussed of a defamation case which raised an issue establish. Could it be shown that there were ‘connec- discussed of a defamation case which raised an issue establish. Could it be shown that there were ‘connec- concerning a complaint of publication ‘by a person ting factors’ which pointed to the conclusion that it concerning a complaint of publication ‘by a person ting factors’ which pointed to the conclusion that it outside the United Kingdom, whether the defendant was with Scotland that the action had the most real outside the United Kingdom, whether the defendant was with Scotland that the action had the most real or another’. He relied on this scenario as giving rise and substantial connection? In such circumstances, a or another’. He relied on this scenario as giving rise and substantial connection? In such circumstances, a to an international element sufficient to engage the stay would ordinarily be granted unless the claimant to an international element sufficient to engage the stay would ordinarily be granted unless the claimant regulation. But the present scenario was different. could demonstrate that there were nonetheless regulation. But the present scenario was different. could demonstrate that there were nonetheless There was only one defendant and it was sued in this circumstances such that justice required that a stay There was only one defendant and it was sued in this circumstances such that justice required that a stay Member State, where it was treated as domiciled. should be refused. The defendant pointed to many Member State, where it was treated as domiciled. should be refused. The defendant pointed to many The only dispute was internal, as between the courts ‘connecting factors’ which indicated Scotland to be The only dispute was internal, as between the courts ‘connecting factors’ which indicated Scotland to be of Scotland and England. There was no reason for the natural and clearly more appropriate forum. Such of Scotland and England. There was no reason for the natural and clearly more appropriate forum. Such the regulation to be engaged and the court was factors included the convenience of the parties and the regulation to be engaged and the court was factors included the convenience of the parties and not precluded from addressing issues of forum non witnesses, the expense of the litigation, the applicable not precluded from addressing issues of forum non witnesses, the expense of the litigation, the applicable conveniens. law, and the place(s) where the parties respectively conveniens. law, and the place(s) where the parties respectively resided or carried on their business. The policy that a resided or carried on their business. The policy that a Sir David Eady then considered the court’s approach citizen of the EU was, subject to specified exceptions, Sir David Eady then considered the court’s approach citizen of the EU was, subject to specified exceptions, to jurisdiction within the UK. The allocation of juris- entitled to assume that he would be sued in his state to jurisdiction within the UK. The allocation of juris- entitled to assume that he would be sued in his state diction internally as between the various consti- of domicile, was a connecting factor which should be diction internally as between the various consti- of domicile, was a connecting factor which should be tuent ‘nations’ or parts of the UK was governed put in the forefront of the court’s consideration. Both tuent ‘nations’ or parts of the UK was governed put in the forefront of the court’s consideration. Both by section16 and Schedule 4 of the 1982 Act (as parties were domiciled in Scotland and the primary by section16 and Schedule 4 of the 1982 Act (as parties were domiciled in Scotland and the primary amended to take account of changes in the Brussels focus of their businesses was also there. The courts in amended to take account of changes in the Brussels focus of their businesses was also there. The courts in Recast Regulation). The structure and wording of England had only a limited jurisdiction, in the sense Recast Regulation). The structure and wording of England had only a limited jurisdiction, in the sense Schedule 4 corresponded closely to those of the that they would only be able to address such damage Schedule 4 corresponded closely to those of the that they would only be able to address such damage current regulation. as was alleged to have occurred in England & Wales, current regulation. as was alleged to have occurred in England & Wales, under the special jurisdiction contemplated by rule 3 under the special jurisdiction contemplated by rule 3 In the present context, what mattered was rule 3(c), of Schedule 4, whereas the Scottish courts would be In the present context, what mattered was rule 3(c), of Schedule 4, whereas the Scottish courts would be which acknowledged a special jurisdiction ‘in matters able to adjudicate upon the whole of the damages which acknowledged a special jurisdiction ‘in matters able to adjudicate upon the whole of the damages relating to tort, delict or quasi-delict’ such that a person claim – including in respect of damage (if any) relating to tort, delict or quasi-delict’ such that a person claim – including in respect of damage (if any) domiciled in one part may be sued in the courts for the accrued in other jurisdictions. If the claimant chose domiciled in one part may be sued in the courts for the accrued in other jurisdictions. If the claimant chose place where the harmful act occurred (or may occur). to sue on matters going wider than harm done in place where the harmful act occurred (or may occur). to sue on matters going wider than harm done in These provisions were subject to those of section 49 England & Wales, it was difficult to see why he should These provisions were subject to those of section 49 England & Wales, it was difficult to see why he should and the doctrine of forum non conveniens. be permitted to do so outside the jurisdiction of the and the doctrine of forum non conveniens. be permitted to do so outside the jurisdiction of the defendant’s domicile. defendant’s domicile. It was appropriate to have in mind the principles It was appropriate to have in mind the principles expounded in Shevill v Presse Alliance [1995] 2 AC The defendant’s solicitor also relied on the events expounded in Shevill v Presse Alliance [1995] 2 AC The defendant’s solicitor also relied on the events 18. Where a libel was published in several jurisdic- underlying this dispute all which took place in 18. Where a libel was published in several jurisdic- underlying this dispute all which took place in tions, a litigant was given the choice of suing where Scotland. The likely defences would be truth and tions, a litigant was given the choice of suing where Scotland. The likely defences would be truth and the defendant was domiciled, where he could qualified privilege involving evidence from members the defendant was domiciled, where he could qualified privilege involving evidence from members recover all relevant remedies, or suing in each of the of the defendant’s staff and those who prepared recover all relevant remedies, or suing in each of the of the defendant’s staff and those who prepared countries where harm was said to have been incurred. the press statement. The issues of negligence would countries where harm was said to have been incurred. the press statement. The issues of negligence would Here, such a policy would require that the claimant also largely turn on evidence relating to what took Here, such a policy would require that the claimant also largely turn on evidence relating to what took choose between Scotland (where the defendant was place in Scotland. So far as data protection was choose between Scotland (where the defendant was place in Scotland. So far as data protection was domiciled or conducted its affairs) and the courts of concerned, the processing took place in Scotland and domiciled or conducted its affairs) and the courts of concerned, the processing took place in Scotland and Italy, France, Brazil and England (where the other the evidence would again overlap considerably with Italy, France, Brazil and England (where the other the evidence would again overlap considerably with offending publications were said to have occurred and that to be called on the other causes of action. It was offending publications were said to have occurred and that to be called on the other causes of action. It was where at least some harm was alleged to have been always important to remember the fundamental test where at least some harm was alleged to have been always important to remember the fundamental test incurred). He had chosen to sue only in England but of ‘substantial justice’. If one was confident that this incurred). He had chosen to sue only in England but of ‘substantial justice’. If one was confident that this had not confined his claim to the harm incurred in could be achieved, as had been conceded in relation had not confined his claim to the harm incurred in could be achieved, as had been conceded in relation that jurisdiction. to Scotland, then the court should guard against giving that jurisdiction. to Scotland, then the court should guard against giving

Communications Law Vol. 23, No. 1, 2018 51 Communications Law Vol. 23, No. 1, 2018 51 Recent Developments Recent Developments

any of these supposed advantages disproportionate was domiciled or, for that matter, had its ‘centre of any of these supposed advantages disproportionate was domiciled or, for that matter, had its ‘centre of significance. The Scottish courts were more than interests’). If and in so far as the claim was allowed to significance. The Scottish courts were more than interests’). If and in so far as the claim was allowed to capable of providing substantial justice in this dispute. proceed in England, it would be right to confine the capable of providing substantial justice in this dispute. proceed in England, it would be right to confine the Most of the connecting factors indicated Scotland issues to those properly arising under the special juris- Most of the connecting factors indicated Scotland issues to those properly arising under the special juris- as the natural forum, in particular the parties were diction. On that rather artificial hypothesis, it was right as the natural forum, in particular the parties were diction. On that rather artificial hypothesis, it was right domiciled or based in Scotland (and the defendant to strike out the global damages claims. domiciled or based in Scotland (and the defendant to strike out the global damages claims. should be sued there in accordance with the general should be sued there in accordance with the general jurisdiction indicated in r 1 of Sched 4). Further jurisdiction indicated in r 1 of Sched 4). Further the Scottish courts could deal with all the remedies Harassment and interim non- the Scottish courts could deal with all the remedies Harassment and interim non- sought, and would not be confined to dealing with disclosure order on persons sought, and would not be confined to dealing with disclosure order on persons the ‘harm’ alleged to have been incurred in Scotland, unknown the ‘harm’ alleged to have been incurred in Scotland, unknown whereas the English courts would (by reason of the whereas the English courts would (by reason of the special jurisdiction) be limited to assessing damage special jurisdiction) be limited to assessing damage suffered in England. Since the claim had such real and GYH v Persons Unknown (Responsible for the suffered in England. Since the claim had such real and GYH v Persons Unknown (Responsible for the substantial connections with Scotland, the claimant Publication of Webpages) [2017] EWHC 3360 (QB) substantial connections with Scotland, the claimant Publication of Webpages) [2017] EWHC 3360 (QB) had an impossible task to show that nonetheless before Mr Justice Warby concerned an applica- had an impossible task to show that nonetheless before Mr Justice Warby concerned an applica- justice required that the case remain in England and tion without notice to the defendant for an interim justice required that the case remain in England and tion without notice to the defendant for an interim the stay was granted. non-disclosure order to restrain a campaign of harass- the stay was granted. non-disclosure order to restrain a campaign of harassment. The claimant was a transgender woman who ment. The claimant was a transgender woman who So far as a claim for global damaged was concerned, worked as an escort, and provided sexual and compa- So far as a claim for global damaged was concerned, worked as an escort, and provided sexual and compa- the defendant argued that if the claim were to go nionship services to her clients under a work name. the defendant argued that if the claim were to go nionship services to her clients under a work name. ahead in England that the claim for damages would The campaign consisted mainly of the publication ahead in England that the claim for damages would The campaign consisted mainly of the publication need to be substantially restricted. The claimant of various items or categories of personal informa- need to be substantially restricted. The claimant of various items or categories of personal informa- should be limited to recovering in respect of England tion or purported information about the claimant. should be limited to recovering in respect of England tion or purported information about the claimant. & Wales. The claims relating to Scotland, Italy, France These included allegations that the claimant had HIV/ & Wales. The claims relating to Scotland, Italy, France These included allegations that the claimant had HIV/ and Brazil should be struck out. This was based on AIDS, and other information or purported informa- and Brazil should be struck out. This was based on AIDS, and other information or purported informa- the reasoning in Shevill v Presse Alliance [1995] 2 AC tion about her sexual life, and her physical and mental the reasoning in Shevill v Presse Alliance [1995] 2 AC tion about her sexual life, and her physical and mental 18, which was authority for the proposition that global health. It was the claimant’s case that the allegation 18, which was authority for the proposition that global health. It was the claimant’s case that the allegation damages would be recoverable only in the courts of the that she had HIV/AIDS was false, as was some of the damages would be recoverable only in the courts of the that she had HIV/AIDS was false, as was some of the contracting state (the expression now used was ‘Member other information about her. Such information conti- contracting state (the expression now used was ‘Member other information about her. Such information conti- State’) where the defendant was domiciled. The relevant nued to be published online at several locations. The State’) where the defendant was domiciled. The relevant nued to be published online at several locations. The contracting state here was of course the UK. claimant’s case was that the publications had caused contracting state here was of course the UK. claimant’s case was that the publications had caused her considerable distress. They were said to amount to her considerable distress. They were said to amount to The claimant argued that the court was being asked harassment by the misuse of private information. The The claimant argued that the court was being asked harassment by the misuse of private information. The to develop a novel sub-national model of Shevill, such claimant also maintained, as part of her claim, and as to develop a novel sub-national model of Shevill, such claimant also maintained, as part of her claim, and as that only courts of the sub-national place where the part of her argument in support of an injunction, that that only courts of the sub-national place where the part of her argument in support of an injunction, that publisher was domiciled would have jurisdiction to some of them were both defamatory and untrue. publisher was domiciled would have jurisdiction to some of them were both defamatory and untrue. award global damages – and all other courts within award global damages – and all other courts within the UK would be restricted to awarding damages for The claimant sued ‘persons unknown’, coupled with the UK would be restricted to awarding damages for The claimant sued ‘persons unknown’, coupled with harm occurring within their relevant regions. But such descriptive wording referring to two world wide web harm occurring within their relevant regions. But such descriptive wording referring to two world wide web a proposition was not odd where there was room for addresses at which content of which the claimant a proposition was not odd where there was room for addresses at which content of which the claimant the application of forum non conveniens within the complained had been published. It was open to a the application of forum non conveniens within the complained had been published. It was open to a Member State, and moreover that Parliament had claimant who could not identify those responsible for Member State, and moreover that Parliament had claimant who could not identify those responsible for approved rules in parallel to those under the Recast the conduct complained of to sue ‘persons unknown.’ approved rules in parallel to those under the Recast the conduct complained of to sue ‘persons unknown.’ Regulation – including those under Schedule 4. Shevill Section 12(2) of the Human Rights Act 1998 prohi- Regulation – including those under Schedule 4. Shevill Section 12(2) of the Human Rights Act 1998 prohi- presented a perfectly defensible framework for bringing bited the court from granting relief which might affect presented a perfectly defensible framework for bringing bited the court from granting relief which might affect consistency to international jurisdiction issues in the the exercise of the Convention right to freedom consistency to international jurisdiction issues in the the exercise of the Convention right to freedom context of publication cases. If it was right that the of expression unless it was satisfied ‘that there are context of publication cases. If it was right that the of expression unless it was satisfied ‘that there are courts in England would only have jurisdiction by compelling reasons why the respondent should not be courts in England would only have jurisdiction by compelling reasons why the respondent should not be reason of rule 3 of Schedule 4 (the special jurisdiction), notified or that the applicant has taken all practicable reason of rule 3 of Schedule 4 (the special jurisdiction), notified or that the applicant has taken all practicable it was difficult to understand why the global damages steps to notify the respondent.’ There was no sugges- it was difficult to understand why the global damages steps to notify the respondent.’ There was no sugges- should be left in. The logical course was to recognise tion that there were any good reasons for not notifying should be left in. The logical course was to recognise tion that there were any good reasons for not notifying that the claim was intended to embrace a range of the defendant and the court was satisfied that the that the claim was intended to embrace a range of the defendant and the court was satisfied that the matters outside the special jurisdiction; accordingly, claimant has taken all the steps that could have been matters outside the special jurisdiction; accordingly, claimant has taken all the steps that could have been those should be determined under the general jurisdic- taken to identify a defendant who might be served those should be determined under the general jurisdic- taken to identify a defendant who might be served tion (ie of the courts of the place where the defendant with the claim. tion (ie of the courts of the place where the defendant with the claim.

52 Communications Law Vol. 23, No. 1, 2018 52 Communications Law Vol. 23, No. 1, 2018 Recent Developments Recent Developments

In relation to the claim there were some categories her online; however, such disclosures and such In relation to the claim there were some categories her online; however, such disclosures and such of personal information that were of an intimate and approval and consent did not mean that the claimant of personal information that were of an intimate and approval and consent did not mean that the claimant plainly sensitive nature: information about sexual life, had entirely surrendered control over her privacy plainly sensitive nature: information about sexual life, had entirely surrendered control over her privacy about sexual health, about physical health, and about and online identity. The campaign of which she about sexual health, about physical health, and about and online identity. The campaign of which she mental health. Information about a person’s sexual complained was a sweeping attack on the values of mental health. Information about a person’s sexual complained was a sweeping attack on the values of conduct and practices, about sexually transmitted autonomy and dignity which were at the heart of the conduct and practices, about sexually transmitted autonomy and dignity which were at the heart of the diseases they had, and about their mental health, was right to privacy. That was an argument which would diseases they had, and about their mental health, was right to privacy. That was an argument which would all information about the person’s private life. The prevail at any trial of the claim. The information which all information about the person’s private life. The prevail at any trial of the claim. The information which right to control what was done with such informa- was the target of this application was of a different right to control what was done with such informa- was the target of this application was of a different tion, and the right to respect for information of these nature entirely from the information that the claimant tion, and the right to respect for information of these nature entirely from the information that the claimant kinds, ranked towards the upper end of the Article appeared to have distributed herself, or to have kinds, ranked towards the upper end of the Article appeared to have distributed herself, or to have 8 hierarchy. That remained true in this case, even if approved. 8 hierarchy. That remained true in this case, even if approved. some of the information was also information relating some of the information was also information relating to and relevant to the claimant’s occupation. That It would be going too far to say that a person provi- to and relevant to the claimant’s occupation. That It would be going too far to say that a person provi- factor was relevant but it did not mean the informa- ding sexual services for reward as an escort had an factor was relevant but it did not mean the informa- ding sexual services for reward as an escort had an tion was not private. unqualified right to decide what information about tion was not private. unqualified right to decide what information about themselves could be made public. A person in that themselves could be made public. A person in that The fact that the claimant was an escort providing business might have to put up with some unwanted The fact that the claimant was an escort providing business might have to put up with some unwanted sexual services was undoubtedly relevant to the disclosures about themselves. On appropriate sexual services was undoubtedly relevant to the disclosures about themselves. On appropriate assessment of her claims. A person’s past conduct facts, no doubt, there would be a public interest assessment of her claims. A person’s past conduct facts, no doubt, there would be a public interest might be relevant to whether they had a reaso- in the circulation of information which the person might be relevant to whether they had a reaso- in the circulation of information which the person nable expectation of privacy. Work of this kind did concerned would not want distributed. If a sex worker nable expectation of privacy. Work of this kind did concerned would not want distributed. If a sex worker not disqualify a person from the protection given to practised unsafe sex and had contracted HIV/AIDS yet not disqualify a person from the protection given to practised unsafe sex and had contracted HIV/AIDS yet private life. But the claimant’s role inevitably meant continued to work there would be a clear justification private life. But the claimant’s role inevitably meant continued to work there would be a clear justification that she was likely to have made public or placed for warning those who might suffer the consequences. that she was likely to have made public or placed for warning those who might suffer the consequences. beyond her control some information about her In Convention terms, the Article 10 rights involved beyond her control some information about her In Convention terms, the Article 10 rights involved sexual life and, on the evidence, she plainly had done would outweigh the Article 8 rights. But the commu- sexual life and, on the evidence, she plainly had done would outweigh the Article 8 rights. But the commu- so. Someone who made information about herself nications complained of in this case were not cast in so. Someone who made information about herself nications complained of in this case were not cast in public might have no reasonable expectation of the form of public health warnings, and nor would public might have no reasonable expectation of the form of public health warnings, and nor would privacy in relation to that or similar information and the channels of distribution seem well-suited to that privacy in relation to that or similar information and the channels of distribution seem well-suited to that hence no right to prevent others from disclosing it. purpose. More importantly, and fundamentally, there hence no right to prevent others from disclosing it. purpose. More importantly, and fundamentally, there It was well-established, however, that there was no was credible and uncontradicted evidence that these It was well-established, however, that there was no was credible and uncontradicted evidence that these question of a person waiving her right to privacy in allegations were false. Here, the claimant stated that question of a person waiving her right to privacy in allegations were false. Here, the claimant stated that a particular zone of her private life, merely by publi- she did not practise unsafe sex, and was HIV negative. a particular zone of her private life, merely by publi- she did not practise unsafe sex, and was HIV negative. cising some information falling within that zone. The There was no public interest in the distribution of cising some information falling within that zone. The There was no public interest in the distribution of ‘zonal’ approach to reasonable expectations of privacy false information of this kind, nor was it reasonable to ‘zonal’ approach to reasonable expectations of privacy false information of this kind, nor was it reasonable to was discredited. The court’s approach had to be more publish false allegations to this effect. was discredited. The court’s approach had to be more publish false allegations to this effect. tailored than that. tailored than that. Similar reasoning applied, if examined from the Similar reasoning applied, if examined from the The court’s attention was drawn to a review of the viewpoint of defamation law. Some at least of the The court’s attention was drawn to a review of the viewpoint of defamation law. Some at least of the claimant’s services on a website seemingly devoted publications complained of conveyed defamatory claimant’s services on a website seemingly devoted publications complained of conveyed defamatory to providing UK ‘punters’ with consumer informa- meanings to the effect that the claimant carried on to providing UK ‘punters’ with consumer informa- meanings to the effect that the claimant carried on tion, and to the claimant’s own response posted later business as an escort providing sexual services even tion, and to the claimant’s own response posted later business as an escort providing sexual services even the same day. The review contained a description of though she had practised unsafe sex and contracted a the same day. The review contained a description of though she had practised unsafe sex and contracted a the claimant, her attributes, the flat, and what the sexually transmitted disease. The claimant was justi- the claimant, her attributes, the flat, and what the sexually transmitted disease. The claimant was justi- two of them did, with a list of positives and negatives, fied in her assertion that imputations of that kind two of them did, with a list of positives and negatives, fied in her assertion that imputations of that kind and an overall evaluation. A number of questions caused serious harm to reputation. The credible and and an overall evaluation. A number of questions caused serious harm to reputation. The credible and and comments followed from two others, before the uncontradicted evidence was that such imputations and comments followed from two others, before the uncontradicted evidence was that such imputations claimant’s response, accompanied by seven pictures were false. There could be no other defence available, claimant’s response, accompanied by seven pictures were false. There could be no other defence available, of herself. at least so far as future publication was concerned. of herself. at least so far as future publication was concerned.

The claimant could be taken to have approved and Objectively assessed, the ‘nub’ of the claimant’s claim The claimant could be taken to have approved and Objectively assessed, the ‘nub’ of the claimant’s claim consented to the disclosure of the information in the was a complaint of harassment. Her evidence of consented to the disclosure of the information in the was a complaint of harassment. Her evidence of review and her response. The claimant acknowledged distress was detailed and convincing. The principal review and her response. The claimant acknowledged distress was detailed and convincing. The principal that the nature of her work meant that she accepted means by which the harassing conduct had been that the nature of her work meant that she accepted means by which the harassing conduct had been the disclosure of some private information about carried out was by the misuse of private information the disclosure of some private information about carried out was by the misuse of private information

Communications Law Vol. 23, No. 1, 2018 53 Communications Law Vol. 23, No. 1, 2018 53 Recent Developments Recent Developments

about the claimant. The fact that some such informa- and commercial. A commercial interest could under- about the claimant. The fact that some such informa- and commercial. A commercial interest could under- tion was false did not undermine the claim. It tended mine an injunction application of this kind for at least tion was false did not undermine the claim. It tended mine an injunction application of this kind for at least rather to support it. The fact that some of the informa- two other reasons: (a) because it would mean that the rather to support it. The fact that some of the informa- two other reasons: (a) because it would mean that the tion happened to be defamatory should not under- defamation rule applied; and (b) because damages tion happened to be defamatory should not under- defamation rule applied; and (b) because damages mine the claim, either. This was not an instance of a would be an adequate remedy: The ﬁrst conside- mine the claim, either. This was not an instance of a would be an adequate remedy: The ﬁrst conside- claimant abusing the process by ‘shopping’ for a cause ration did not operate here and the second did not claimant abusing the process by ‘shopping’ for a cause ration did not operate here and the second did not of action which would help her avoid the application apply because, there was a sincere and credible case of action which would help her avoid the application apply because, there was a sincere and credible case of the defamation rule. that the claimant continued to suffer distress which of the defamation rule. that the claimant continued to suffer distress which could not in principle or in practice be compensated could not in principle or in practice be compensated It was apparent that this claim had a commercial by money. It was apparent that this claim had a commercial by money. motive behind it, as well as a personal and private motive behind it, as well as a personal and private one. If a claim was brought to protect a reputation The claimant had persuaded the court that she would one. If a claim was brought to protect a reputation The claimant had persuaded the court that she would for commercial reasons, that could tend to weaken succeed at trial in establishing that the continuing for commercial reasons, that could tend to weaken succeed at trial in establishing that the continuing if not undermine a claim to restrain publication as publication and other harassing conduct should be if not undermine a claim to restrain publication as publication and other harassing conduct should be a misuse of private information. That might be so restrained, and she was therefore entitled in principle a misuse of private information. That might be so restrained, and she was therefore entitled in principle because it weakened the case that the information to an injunction to prevent the continuation of the because it weakened the case that the information to an injunction to prevent the continuation of the was private. However, the information about sexual harassment to which she had been subjected. was private. However, the information about sexual harassment to which she had been subjected. conduct and sexual health was inherently both private conduct and sexual health was inherently both private

54 Communications Law Vol. 23, No. 1, 2018 54 Communications Law Vol. 23, No. 1, 2018 Notes Notes

Communications Law Vol. 23, No. 1, 2018 Communications Law Vol. 23, No. 1, 2018 Notes Notes

Communications Law Vol. 23, No. 1, 2018 Communications Law Vol. 23, No. 1, 2018