Статья 8 📖 GDPR. Условия, применимые к согласию ребенка в случае оказания услуг информационного общества

제8조 GDPR. 정보사회 서비스와 관련하여 아동의 동의에 적용되는 조건

Article 8 GDPR. Conditions applicable to child's consent in relation to information society services

1. 제6조(1)의 (a)호가 적용되는 경우, 아동에게 직접 이루어지는 정보사회서비스 제공과 관련하여 아동의 개인정보의 처리는 해당 아동이 최소 16세 이상인 경우에 적법하다. 아동이 16세 미만인 경우, 그 같은 처리는 해당 아동의 친권을 보유한 자가 동의를 제공하거나 승인한 경우에만 적법하다.

1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

Руководство и прецедентное право Связанные статьи

Руководство и прецедентное право

(EN)

Documents

Article 29 Working Party, Guidelines on Consent under Regulation 2016/679 (2018).

The inclusion of the wording ‘offered directly to a child’ indicates that Article 8 is intended to apply to some, not all information society services. In this respect, if an information society service provider makes it clear to potential users that it is only offering its service to persons aged 18 or over, and this is not undermined by other evidence (such as the content of the site or marketing plans) then the service will not be considered to be ‘offered directly to a child’ and Article 8 will not apply.

Article 29 Working Party, Guidelines on transparency under Regulation 2016/679 (2018).

Where a data controller is targeting children[16] or is, or should be, aware that their goods/services are particularly utilised by children (including where the controller is relying on the consent of the child)[17], it should ensure that the vocabulary, tone and style of the language used is appropriate to and resonates with children so that the child addressee of the information recognises that the message/ information is being directed at them.[18] A useful example of child-centred language used as an alternative to the original legal language can be found in the “UN Convention on the Rights of the Child in Child Friendly Language”.[19]

Связанные статьи

제6조 GDPR. 처리의 적법성

Article 6 GDPR. Lawfulness of processing

1. 개인정보 처리는 적어도 다음 각 호의 하나에 해당되고 그 범위에서만 적법하다.

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) 정보주체가 하나 이상의 특정 목적에 대해 본인의 개인정보 처리를 동의한 경우

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

[…]

Guidelines on consent under Regulation 2016/679

Information society service

129. While assessing the scope of this definition, the EDPB also refers to case law of the ECJ.[62] The ECJ held that information society services cover contracts and other services that are concluded or transmitted on-line. Where a service has two economically independent components, one being the online component, such as the offer and the acceptance of an offer in the context of the conclusion of a contract or the information relating to products or services, including marketing activities, this component is defined as an information society service, the other component being the physical delivery or distribution of goods is not covered by the notion of an information society service. The online delivery of a service would fall within the scope of the term information society service in Article 8 GDPR.

_{[62] See European Court of Justice, 2 December 2010 Case C-108/09, (Ker-Optika), paragraphs 22 and 28. In relation to ‘composite services’, the EDPB also refers to Case C-434/15 (Asociacion Profesional Elite Taxi v Uber Systems Spain SL), para 40, which states that an information society service forming an integral part of an overall service whose main component is not an information society service (in this case a transport service), must not be qualified as ‘an information society service’.}

Offered directly to a child

130. The inclusion of the wording ‘offered directly to a child’ indicates that Article 8 is intended to apply to some, not all information society services. In this respect, if an information society service provider makes it clear to potential users that it is only offering its service to persons aged 18 or over, and this is not undermined by other evidence (such as the content of the site or marketing plans) then the service will not be considered to be ‘offered directly to a child’ and Article 8 will not apply.

회원국은 상기의 목적에 대한 아동의 연령을 법률로서 낮추어 규정할 수 있으나, 해당 연령이 13세 미만이 되어서는 안 된다.

Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.

2. 그 같은 경우 컨트롤러는 가용한 기술을 고려하여 해당 아동의 친권을 보유한 자가 동의를 제공하거나 승인하였는지를 입증하기 위한 합당한 노력을 기울여야 한다.

2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.

Комментарий эксперта Руководство и прецедентное право

Комментарий эксперта

(EN) Example. An online gaming platform wants to make sure underage customers only subscribe to its services with the consent of their parents or guardians. The controller follows these steps:

Step 1: ask the user to state whether they are under or over the age of 16 (or alternative age of digital consent)If the user states that they are under the age of digital consent:

Step 2: service informs the child that a parent or guardian needs to consent or authorise the processing before the service is provided to the child. The user is requested to disclose the email address of a parent or guardian.

Step 3: service contacts the parent or guardian and obtains their consent via email for processing and take reasonable steps to confirm that the adult has parental responsibility.

Step 4: in case of complaints, the platform takes additional steps to verify the age of the subscriber. If the platform has met the other consent requirements, the platform can comply with the additional criteria of Article 8 GDPR by following these steps.

Source: EDPB, Guidelines on Consent under Regulation 2016/679, WP259 rev.01 (2018)

Руководство и прецедентное право

(EN) Article 29 Working Party, Guidelines on Consent under Regulation 2016/679, WP259 rev.01 (2018):

What is reasonable, both in terms of verifying that a user is old enough to provide their own consent, and in terms of verifying that a person providing consent on behalf of a child is a holder of parental responsibility, may depend upon the risks inherent in the processing as well as the available technology. In low-risk cases, verification of parental responsibility via email may be sufficient. Conversely, in high-risk cases, it may be appropriate to ask for more proof, so that the controller is able to verify and retain the information pursuant to Article 7(1) GDPR. Trusted third party verification services may offer solutions which minimise the amount of personal data the controller has to process itself.

3. 제1항은 아동과 관련한 계약의 유효성, 형식 또는 효력에 대한 규정 등 회원국의 일반 계약 법률에 영향을 미칠 수 없다.

3. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.

ISO 27701

ISO/IEC 27701, принятый в 2019, добавил дополнительное руководство к ISO/IEC 27002 для контролеров персональных данных (ПИИ).

Приводим соответствующий параграф к статье 8(3) GDPR:

7.2.2 Определение правового основания

Средство управления
Организация должна определить, задокументировать и соблюдать соответствующие правовые основания для обработки ПИИ в определенных целях.

Руководство по внедрению
В некоторых юрисдикциях организация должна иметь возможность продемонстрировать, что законность обработки была должным образом установлена до её осуществления.
Правовое основание для обработки ПИИ может включать в себя:

…

Войти
для доступа к полному тексту

유럽연합 일반 데이터 보호 규칙(EU GDPR)

Source: http://www.pipc.go.kr/cmt/not/ntc/selectBoardArticle.do?nttId=5969&bbsId=BBSMSTR_000000000121&bbsTyCode=BBST03&bbsAttrbCode=BBSA03&authFlag=Y&pageIndex=6

General Data Protection Regulation (EU GDPR)

The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.

Комментарий эксперта ISO 27701 Преамбулы Руководство и прецедентное право Оставить комментарий

Комментарий эксперта

Дети пользуются особой защитой в соответствии с GDPR, поскольку они считаются уязвимыми лицами (Guidelines on Consent). Они еще не достигли физической и психологической зрелости (Opinion 2/2009), поэтому они могут быть в меньшей степени, чем взрослые, осведомлены о рисках и последствиях распространения своей личной информацией при регистрации в онлайн-сервисах или использовании подключенных платформ (преамбула 38).

Статья 8 касается ограниченного числа ситуаций. Из формулировки данной статьи, рассматриваемой в совокупности со статьей 6(1) (а), следует, что она применяется только при условии соблюдении двух нижеуказанных положений…

…

Войти
для доступа к полному тексту

Автор

Луи-Филипп Граттон PhD, LLM

Эксперт в Privacy

Задать вопрос

ISO 27701

Приводим соответствующий параграф к статье 8(1) и 8(2) GDPR:

7.2.3 Дисциплинарные меры

Средство управления

Должен быть разработан и доведен до сведения персонала процесс для принятия мер к тем сотрудникам, которые допустили нарушение требований информационной безопасности.

Руководство по внедрению

Дисциплинарные меры не могут быть применены без предварительной проверки того, что нарушение информационной безопасности действительно имело место (см. 16.1.7).

…

Войти
для доступа к полному тексту

Преамбулы

(38) 아동은 개인정보 처리에 따른 위험성, 결과, 이에 필요한 안전장치 및 본인의 권리를 잘 인지하지 못하고 있기 때문에 본인의 개인정보와 관련하여 구체적인 보호를 받아야 한다. 특정한 보호는 특히 마케팅 또는 사용자 프로필이나 가성인격 생성의 목적으로 아동의 개인정보를 사용하는 경우와 아동에게 직접 제공되는 서비스의 이용 시 아동과 관련한 개인정보를 수집하는 경우에 적용되어야 한다. 아동에게 직접 제공되는 예방 서비스 또는 카운슬링의 경우에는 친권 보유자의 동의가 필수적이지 않다.

(38) Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to a child. The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child.

Руководство и прецедентное право

(EN)

Documents

Article 29 Working Party, Opinion 2/2009 on the Protection of Children’s Personal Data (General Guidelines and the Special Case of Schools) (2009).

EDPB, Guidelines 5/2020 on Consent under Regulation 2016/679 (2020).

ICO, Age Appropriate Design: A Code of Practice for Online Services (2020).

Case Law

CJEU, Data Protection Commissioner/Facebook Ireland Ltd and Schrems, C-311/18 (2020).

Оставить комментарий

[js-disqus]