Navigatsioon
GDPR > Artikkel 8. Tingimused, mida kohaldatakse lapse nõusolekule seoses infoühiskonna teenustega
Allalaadimine

Artikkel 8 GDPR. Tingimused, mida kohaldatakse lapse nõusolekule seoses infoühiskonna teenustega

Article 8 GDPR. Conditions applicable to child's consent in relation to information society services

1. Kui kohaldatakse artikli 6 lõike 1 punkti a seoses infoühiskonna teenuste pakkumisega otse lapsele, on lapse isikuandmete töötlemine seaduslik ainult juhul kui laps on vähemalt 16-aastane. Kui laps on noorem kui 16-aastane, on selline isikuandmete töötlemine seaduslik üksnes sellisel juhul ja sellises ulatuses, kui selleks on sellise nõusoleku või loa andnud isik, kellel on lapse suhtes vanemlik vastutus.

1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

Suunised & Case Law Ühendused

Liikmesriigid võivad seadusega sätestada madalama asjaomase vanuse, tingimusel et selline madalam vanus ei ole vähem kui 13 aastat.

Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.

2. Vastutav töötleja teeb kättesaadavat tehnoloogiat arvesse võttes mõistlikud jõupingutused selleks, et kontrollida sellistel juhtudel, et nõusoleku või loa on andnud isik, kellel on lapse suhtes vanemlik vastutus.

2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.

Ekspertide kommentaar
Suunised & Case Law

3. Lõige 1 ei mõjuta liikmesriikide üldist lepinguõigust, näiteks õigusnorme, mis käsitlevad lapsega seotud lepingu kehtivust, koostamist ja mõju.

3. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 8(3) GDPR:

7.2.2 Identify lawful basis

Control

The organization should determine, document and comply with the relevant lawful basis for the processing of PII for the identified purposes.

Implementation guidance

Some jurisdictions require the organization to be able to demonstrate that the lawfulness of processing was duly established before the processing.

The legal basis for the processing of PII can include:


terviktekstile juurdepääsuks

Ekspertide kommentaar ISO 27701 Põhjendustes Suunised & Case Law Jäta kommentaar
Ekspertide kommentaar

(EN) Children enjoy special protection under the General Data Protection Regulation as they are considered vulnerable (Guidelines on Consent). They did not indeed achieve physical and psychological maturity yet (Opinion 2/2009 on the Protection of Children’s Personal Data), so they may be less aware than adults of the risks and consequences of sharing their personal information when registering for online services or using connected platforms (recital 38).


terviktekstile juurdepääsuks

(EN) Author
Louis-Philippe Gratton
(EN) Louis-Philippe Gratton PhD, LLM
(EN) Privacy Expert
ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to articles 8(1) and 8(2) GDPR:

7.2.3 Determine when and how consent is to be obtained

Control

The organization should determine and document a process by which it can demonstrate if, when and how consent for the processing of PII was obtained from PII principals.

Implementation guidance

Consent can be required for processing of PII unless other lawful grounds apply. The organization should clearly document when consent needs to be obtained and the requirements for obtaining consent.


terviktekstile juurdepääsuks

Põhjendustes

(38) Laste isikuandmed väärivad erilist kaitset, kuna lapsed ei pruugi olla piisavalt teadlikud asjaomastest ohtudest, tagajärgedest ja kaitsemeetmetest ning oma õigustest seoses isikuandmete töötlemisega. Niisugune eriline kaitse peaks eelkõige rakenduma laste isikuandmete kasutamisel turunduse eesmärgil või isiku või kasutajaprofiili loomiseks ja laste isikuandmete kogumisel otse lastele pakutavate teenuste kasutamise puhul. Vanemliku vastutuse kandja nõusolekut ei peaks olema vaja seoses lapsele otse pakutavate ennetavate või nõustamisteenustega.

(38) Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to a child. The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child.

Suunised & Case Law Jäta kommentaar