white_paper_on_data_protection_in_india_171127_final_v2

data of children takes place on the basis of consent, the EU GDPR has established a parental
consent requirement on websites, which offer ―information society services‖ 433 directly to
children under the age of 16. 434 Lack of harmonised general rules on children‘s data
processing and consent, led to individual EU Member States to nationally set age-limits for
children, at which parental consent would be required. For instance, the data protection law in
Spain provides that data pertaining to data subjects over the age of 14 may be processed with
their consent. 435
South Africa
The POPI Act prohibits the processing of personal information of a child, unless certain
special conditions allowing such processing apply. 436 These include where a competent
person has earlier consented to such processing; where processing may be necessary for the
establishment of a legal claim; where it is necessary to carry out a public interest task and so
on. The POPI Act clarifies that any person who is below the age of 18, and who is not legally
competent to take a decision on her behalf, is considered a child.
Australia
The Privacy Act provides that, in order for consent to be valid, an individual must have the
capacity to consent. An organisation can presume that every individual has the capacity to
consent, unless there is something to suggest otherwise, for instance, if the data being
collected is that of a child. The Privacy Act does not specify a certain minimum age, after
which an individual can make her own privacy decisions. If an organisation is handling the
personal information of an individual under the age of 18 and knows this, the organisation
must determine on a case-by-case whether that individual has the capacity to provide
consent. 437 If the organisation is unable to gauge the capacity of the individual on a case-bycase
basis, then it is presumed that an individual has the capacity to do so. 438
Canada
433 An Information Society Service is defined as ―any service normally provided for remuneration, at a distance,
by electronic means and at the individual request of a recipient of services.‖ Article 1(1)(b) of Directive
2015/1535 of the European Parliament and of the Council.
434 Article 8, EU GDPR.
435 Article 13, Data Protection Act (Law 15/1999 on the protection of personal data).
436 Sections 34 and 35, POPI Act.
437 The APP guidelines state:
„As a general principle, an individual under the age of 18 has the capacity to consent when they have sufficient
understanding and maturity to understand what is being proposed. In some circumstances, it may be
appropriate for a parent/guardian to consent on behalf of a younger person.‟ OAIC, ‗Australian Privacy
Principles Guidelines: Privacy Act 1988‘ (February 2014), available at:
https://www.oaic.gov.au/images/documents/privacy/applying-privacy-law/app-guidelines/APP-guidelinescombined-set-v1.pdf,
(last accessed 28 October 2017).
438
OAIC, ‗Protection of Children‘s Privacy in Focus‘ (11 May 2015), available at:
https://www.oaic.gov.au/media-and-speeches/media-releases/protection-of-children-s-privacy-in-focus,
accessed 28 October 2017).
(last
88