When processing personal data of minors (children under the age of 18), they are entitled to specific protection, as they are often less aware of their rights and the potential risks and/or consequences associated with the processing of their data.

Transparancy

Like adults, minors should be informed about what personal data are being collected about them, what it will be used for, what the risks are, what the rules, safeguards and rights related to the planned processing are, and how to exercise their rights.

This information should be appropriate to the age of the minor(s).

It is the researcher’s job to inform minors in a clear and understandable way, using a medium that is appropriate to the minor's environment and discernment (such as a video, an animation, an information sheet with illustrations, pictograms). In particular, as a researcher, you should use clear and simple language so that the minor for whom the information is intended understands that the message/information is addressed to him or her.

 

Even when the parents/guardian must give consent to the research, minors retain their right to information. In that case, you must inform both the parents/guardian and the minor in an appropriate manner.

Legal ground

Processing personal data of minors (children -18 years old) requires a legal basis.

Consent from minors

Consent for the processing of personal data

In the context of scientific research with minors, at UGent we start from consent as the legal basis. But in a number of well-defined cases (e.g. when sensitive issues are at the core of the child's privacy or when no guardian can be contacted due to circumstances, such as research into the psychological well-being of unaccompanied minor refugees (from 14 years of age) on their way through Europe) the processing may also be necessary in the general interest or in the legitimate interest of UGent or a third party. If scientific research involving minors is based on the legal basis of legitimate interest, a very careful assessment must be made to ensure that the fundamental rights and freedoms of the minors do not outweigh the interests of UGent or the third party in the context of the research.

If personal data of minors are collected and processed on the basis of the legal ground of consent, it is important that this consent fulfils several conditions (e.g., consent must be free and specific and must be actively given prior to processing).

However, since minors do not possess full legal capacity, the researcher must seek this consent (in an appropriate manner) from the person with parental responsibility.

However, from an ethical standpoint, it is recommended that minors also be asked for their assent to the processing of their personal data, except in very special cases (e.g., experimental studies or research with very young children). Again, it is advisable to use a medium appropriate to the environment and discernment of the minor (such as a video, an animation, an information sheet with illustrations).

Minors and consent to the processing of personal data: what age?

In certain contexts (e.g., social media), reference is sometimes made to minors who could give their own consent from the age of 13 or 16. This originates in the GDPR, which sets the age limit for minors to independently consent to the processing of personal data at 16 years. This only applies when it comes to information society services.

Member states can further lower this age to a minimum of 13 years. Belgium has made use of this possibility and opted for the lower limit of 13 years (see Article 6, Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data).

However, this reduction to 16 years under the GDPR and 13 years in Belgium does not apply to (any) research, but only when it involves (1) a direct offer of information society services; (2) to a child; (3) where the processing of personal data is based on consent.

'Information society services' include “any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services.” Examples include services offered by Facebook, Twitter, Bol.com, Google .... Not every research thus includes an "information society service”.

Consequently, for scientific research involving minors under the age of 18, in most cases consent to the processing of personal data will have to be given by the minor's legal representative, and the age reduction will not apply.

Minors and consent to participate in a study

The consent to process personal data (legal basis under the GDPR) is not the same consent that may be required for participation in the research (ethical consent). However, in one form and information letter you can ask for both ethical and legal consent. It is important here that the information letter and consent form fully cover all aspects of data collection and protection, including what happens to the data afterwards and how it is (potentially) disseminated.

Profiling

When you create personality or user profiles of minors in your research to, for example, analyse and predict their behaviour or personal preferences, these minors are also entitled to specific additional protection. Profiles may be created in research based on data collected about minors (e.g. online or offline behavioural data). From that data, preferences or characteristics of minors can be derived that are used to make predictions. Such profiles and predictions regarding minors can be intrusive and privacy-sensitive; taking additional measures is thus necessary. You are therefore required to conduct a risk analysis, called a data protection impact assessment (abbreviated "DIA"), before the start of processing.

This is even more the case when these profiles and predictions lead to automated decision making (without human intervention), which may have legal consequences for the minor (such as, e.g., a study that classifies children into risk categories by algorithms based on police data). The GDPR therefore prohibits processing activities that lead to purely automatically formed decisions with respect to children, if that decision has legal consequences or otherwise significantly affects the child. Exclusive automated decision-making should not influence a child's choices and behaviour.

Exercise of rights by the minor

Minors have the same rights as adults. The rights granted by the GDPR to the data subject (including in research) are personal rights. The Belgian Data Protection Authority states that the exercise of rights belongs in the first place to the minor himself, as a data subject in the research, when he possess full legal capacity. Thus, for example, a minor may himself ask to correct his processed personal data (right of rectification). However, if the minor consents, the legal representative may exercise the minor's rights on behalf of or together with the minor.

However, applying common law, it must be accepted that there are exceptions to this principle, such as for incompetent minors (who do not have sufficient discernment): here, an adult who has parental responsibility will exercise the minor's rights on the minor's behalf. A minor that does not possess full legal capacity must therefore be represented by his legal representative. This exercise must be done in accordance with the rules on parental authority (both parents must do this together) and only in the best interests of the child.

Thus, the rights can be exercised as follows:

Competent minor (minor understand his/her rights)	Capable minor exercises his/her rights alone. However, legal representative may exercise his/her rights jointly/only with minor when minor gives consent.
Incompetent minor (minor does not understand his/her rights)	Legal representative exercises rights. A request to exercise a particular right should in principle be made by both parents who have joint parental authority.

 

This once again shows how important it is that both minors and parents are infornmed about the possible rights and who they can contact to exercise their rights. The researcher involved in the research will usually be the first contact person for this.