Protection of children’s personal data and where reforms are needed

Abstract

This paper explores the world of children’s data. This area is garnering global attention due to its complexity and is rapidly changing. We will look at children’s data laws and collection in the United States as an example of how longtime child protective laws are compared with newer legislation in the European Union (EU), United Kingdom and other jurisdictions. This microcosm offers a window into many aspects of data governance, which affects adults as well. This is because data collected on children touches all aspects of society, education, healthcare, sports and recreation, and also impacts what is known about their families. Children’s data is an especially vulnerable link in the data ecosystem and is often misappropriated and used to access large amounts of consumer data without the knowledge of those consumers. Ignoring this is risky, and regulating this area is complex. The paper looks at how children’s rights have been viewed historically, including by the United Nations Convention on the Rights of the Child (UNCRC), which established core principles and by example, the United States, which has overlapping laws in key youth sectors, education, online entertainment and health. We look at newer laws and guidance, including California Consumer Privacy Act (CCPA), EU’s General Data Protection Regulation (GDPR), UK’s Age Appropriate Design Code (AADC) and others in terms of how they perceive children’s rights and are addressing privacy threats that children face. While it is not comprehensive, this looks at how children’s privacy rights are regulated, what mechanisms can be used to support their rights and recommends what needs to be addressed going forwards.