The need for publication must always be carefully assessed
The following imaginary examples are typical of hobby activities:
- A video of a child’s performance at a concert has been filmed and posted on social media.
- A child’s results are published on a team’s website.
- The sex, age, height, weight or other physiological data of a child is published on the event website of a sporting competition.
- Photos of a child are posted on social media in connection with an event.
- A child’s skills or appearance are assessed on social media by commenting on videos or pictures taken of him/her.
The photos and videos, name and other information associated with the child are personal data. There are always risks associated with the disclosure of the personal data of children and young people. Videos and photos can easily be turned into digital forgeries, which can be used, for example, to engage in bullying. The child can be judged and criticised if a video or picture of him/her is publicly shared for anyone to see. Information shared online can, in the worst case, expose a child or young person to sexual harassment and abuse. For example, on social media, strangers can collect information about a child and then approach him/her in a private message, asking to exchange photos and location information, for example.
The person publishing such information must assess on a case-by-case basis whether the disclosure of the child’s information is necessary and what the purpose of the disclosure is. The necessity should be assessed particularly carefully when publishing identifiable photographs and videos, audio files or precise physiological data.
Consent or legitimate interest as a basis for publication
Publication always requires a basis for it, which can be consent or a legitimate interest. Children’s photos or videos must not be posted online without the consent of the young person or his/her parent. Consent is also required if, for example, a child appears in an article or blog by an association. In the case of a young child, the consent of the child’s parents must be requested. In the case of young people, it is necessary to assess separately whether the young person understands the meaning of the consent given. Consent may also be withdrawn, in which case the data must be removed from the internet.
Under certain circumstances, personal data may be published without consent if publication is justified and necessary for legitimate interests. An association must determine the legitimate interests before publishing the information. The legitimate interests of the association may relate, for example, to increasing member engagement through the publication of information or to increasing the visibility of the association, for example by marketing and communicating about upcoming competitions or concerts. For example, publishing the names of children performing at a concert can be part of the communication for the event. Legitimate interests may also exist where the public and members of an association need to know information about a hobby for the purposes of participation in a competition or tournament and for monitoring and supervision purposes (e.g. gender, age and weight categories, results).
However, the association should note that legitimate interest as a basis for publication requires that the interests and rights of the child or young person have been particularly carefully assessed by means of a balance test.
The legitimate interest of an association must be weighed up in relation to the rights of the child
A child and his/her parents have the right to object to the disclosure of information, even if there is a legitimate interest in disclosure. This is called the right to object, and the association must always inform you of this right before publishing your child’s personal data. However, the information may be published despite objections, if the association can demonstrate that there are legitimate and important reasons for disclosure that override the interests, rights and liberties of the child. This requires the publishing party to carefully assess the legitimate interests in relation to the rights and interests of the child, i.e. to have carried out a balance test.
The publishing party must always carefully consider whether it is necessary to publish the information. Information should not be put online without justification, even if consent has been given. This is particularly important when it comes to children. The controller is ultimately responsible for the lawfulness of the processing of personal data, i.e. that publication has been carried out in accordance with the law.
Checklist for the publication of information by hobby organisers
- Assess the risks of publishing the information, especially from the child’s point of view. How can the risks to the child be reduced?
- Assess what information needs to be published and try to minimise the amount of information published. For example, instead of publishing identifiable photos of children, might it be possible rather to publish photos of the content of the activity.
- Carefully assess from the perspective of the rights of the child, where information should be published. Could the information be published only on the association’s members’ website rather than on a website open to all?
- Inform the children and/or their parents/guardians in advance, in as understandable a way as possible, about the disclosure of their personal data and their data protection rights.
- Specify the grounds for disclosure of personal data, such as consent or legitimate interest (note: the grounds may also be, for example, the performance of a contract, which is not covered in this article).
- In the case of a legitimate interest, assess whether the interest of the association or third party is in fact legitimate and in balance with the rights of the child. What legitimate interests does publishing the data promote? Can the child or his/her parents reasonably expect that the personal data will be published?
- Remember that the child or his/her parents have the right to object to the disclosure of their personal data based on legitimate interest.
- Remember that the child or his/her parents have the right to withdraw consent. In that case, the data must be deleted from the internet.
The GDPR4CHLDRN project provides information about the protection of personal data and data protection rights to children, young people and their parents. Materials targeted at them as well as icons that clarify concepts related to data protection will be developed in the project. In addition, a toolkit to support compliance with data protection legislation and its application will be created for associations and hobby clubs that organise hobby activities for children and young people.
- A two-year project that will end in August 2024.
- The project is funded by the Citizens, Equality, Rights and Values programme of the European Union.
- The project coordinator is the Office of the Data Protection Ombudsman, and its partner in the project is the TIEKE Finnish Information Society Development Centre.
Funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or European Commission. Neither the European Union nor the granting authority can be held responsible for them.
