Captured source text (L5)
Having regard to privacy under the Act
5.11Services likely to be accessed by children have a duty when deciding on, and implementing,
safety measures, to have particular regard to the importance of protecting users from a
breach of any statutory provision or rule of law concerning privacy.49 Where we have
concerns that a provider has not complied with its obligations under data protection laws,
we may refer the matter to the ICO.
5.12To demonstrate compliance with this duty, service providers may find it helpful to include
details of how they have taken privacy into account when implementing highly effective age
assurance in their written record (see paragraph 2.7).
5.13The examples listed below, which reflect relevant principles set out in the ICO’s Children’s
code, are ways to demonstrate consideration of data protection law, which service
providers may wish to provide details on in the written record.
42 ICO, Principle (c): Data minimisation.
43 ICO, Principle (d): Accuracy.
44 ICO, Principle (e): Storage limitation.
45 ICO, Principle (f): Integrity and confidentiality (security).
46 ICO, Accountability and governance.
47 A summary of the 15 standards can be found at ICO, ‘Code standards’ in Age appropriate design: a code of
practice for online services.
48 ICO, Children’s code guidance and resources.
49 Section 22(3) of the Act.
23
• Conducting a Data Protection Impact Assessment (DPIA). These are required by data
protection law where processing is likely to result in a high risk to the rights and
freedoms of individuals. DPIAs will assist service providers in identifying and mitigating
the risks arising from their processing of personal data, which can help demonstrate
that they have had regard to the importance of protecting users from a breach of any
statutory provision or rule of law concerning privacy. As set out in Standard 2 of the
Children’s code, a DPIA can also help services to minimise and identify the specific risks
to children who are likely to access the service which arise from the processing of their
personal data.50 Detailed guidance on how to carry out a DPIA, and a sample template,
can be found on the ICO website.
• Providing privacy information to users. Service providers should give users information
about why they need to provide any personal data, how it will be processed, how long
it will be retained, and if it will be shared with anyone else. Doing so in a child-friendly
way will also help services to meet Standard 4 of the Children’s code: transparency.51
More information on privacy notices can be found on the ICO website.52
• Keeping written records of processing activities. Most organisations that process
personal data must document their processing activities to some extent.53
• Having up to date data protection policies along with a record of how providers make
staff aware of them. This provides staff with clarity and consistency around their data
protection obligations.54
• Having a record of which staff have completed any data protection training
programme that is in place. This helps to ensure all staff have adequate knowledge of
data protection, as appropriate for their role.55
• Clearly documenting technical and organisational security measures.56
50 ICO, 2. Data protection impact assessments
51 ICO, 4: Transparency
52 See ICO, Transparency (cookies and privacy notices) and ICO, How to write a privacy notice and what goes in
it.
53 ICO, Records of processing and lawful basis. Also see ICO, Governance and Accountability in Age appropriate
design: a code of practice for online services.
54 ICO, Policies and procedures. Also see ICO, Governance and Accountability in Age appropriate design: a code
of practice for online services.
55 ICO, Training and awareness. Also see ICO, Governance and Accountability in Age appropriate design: a code
of practice for online services.
56 ICO, A guide to data security.
24
Full captured verbatim text
5.11 Services likely to be accessed by children have a duty when deciding on, and implementing, safety measures, to have particular regard to the importance of protecting users from a breach of any statutory provision or rule of law concerning privacy.49 Where we have concerns that a provider has not complied with its obligations under data protection laws, we may refer the matter to the ICO. 5.12 To demonstrate compliance with this duty, service providers may find it helpful to include details of how they have taken privacy into account when implementing highly effective age assurance in their written record (see paragraph 2.7). 5.13 The examples listed below, which reflect relevant principles set out in the ICO’s Children’s code, are ways to demonstrate consideration of data protection law, which service providers may wish to provide details on in the written record. 42 ICO, Principle (c): Data minimisation. 43 ICO, Principle (d): Accuracy. 44 ICO, Principle (e): Storage limitation. 45 ICO, Principle (f): Integrity and confidentiality (security). 46 ICO, Accountability and governance. 47 A summary of the 15 standards can be found at ICO, ‘Code standards’ in Age appropriate design: a code of practice for online services. 48 ICO, Children’s code guidance and resources. 49 Section 22(3) of the Act. 23 • Conducting a Data Protection Impact Assessment (DPIA). These are required by data protection law where processing is likely to result in a high risk to the rights and freedoms of individuals. DPIAs will assist service providers in identifying and mitigating the risks arising from their processing of personal data, which can help demonstrate that they have had regard to the importance of protecting users from a breach of any statutory provision or rule of law concerning privacy. As set out in Standard 2 of the Children’s code, a DPIA can also help services to minimise and identify the specific risks to children who are likely to access the service which arise from the processing of their personal data.50 Detailed guidance on how to carry out a DPIA, and a sample template, can be found on the ICO website. • Providing privacy information to users. Service providers should give users information about why they need to provide any personal data, how it will be processed, how long it will be retained, and if it will be shared with anyone else. Doing so in a child-friendly way will also help services to meet Standard 4 of the Children’s code: transparency.51 More information on privacy notices can be found on the ICO website.52 • Keeping written records of processing activities. Most organisations that process personal data must document their processing activities to some extent.53 • Having up to date data protection policies along with a record of how providers make staff aware of them. This provides staff with clarity and consistency around their data protection obligations.54 • Having a record of which staff have completed any data protection training programme that is in place. This helps to ensure all staff have adequate knowledge of data protection, as appropriate for their role.55 • Clearly documenting technical and organisational security measures.56 50 ICO, 2. Data protection impact assessments 51 ICO, 4: Transparency 52 See ICO, Transparency (cookies and privacy notices) and ICO, How to write a privacy notice and what goes in it. 53 ICO, Records of processing and lawful basis. Also see ICO, Governance and Accountability in Age appropriate design: a code of practice for online services. 54 ICO, Policies and procedures. Also see ICO, Governance and Accountability in Age appropriate design: a code of practice for online services. 55 ICO, Training and awareness. Also see ICO, Governance and Accountability in Age appropriate design: a code of practice for online services. 56 ICO, A guide to data security. 24