Regulation and data
Children's data
Children's data are the personal data of people under eighteen. The GDPR calls for specific protection for them and, in Spain, the LOPDGDD sets fourteen as the age from which they can consent on their own to the processing of their data. In a student residence they appear with anyone who starts university at seventeen.
Also known asminors' personal data · children's consent · datos de menores
What changes with age
Recital 38 gives the reason: children may be less aware of the risks and of their rights. Art. 8 of the GDPR sets sixteen for online services offered directly to them and lets each State lower it to thirteen; Spain's LOPDGDD sets fourteen for any processing based on consent (art. 7).
| Under 14 | Aged 14 to 17 | |
|---|---|---|
| Consent | Given by whoever holds parental authority or guardianship (art. 7.2) | Given by the minor, unless the law requires their parents' assistance for that act (art. 7.1) |
| Access, erasure and the other rights | Their parents or guardians may exercise them on their behalf (art. 12.6) | Exercised by the minor, directly or through a representative (art. 12.1) |
| Their photo on social media | Consent of their representatives (art. 92) | Their own consent (art. 92) |
Worth knowing
Consenting is not signing the contract. That a seventeen-year-old resident can consent to the processing of their data does not settle whether they can sign the accommodation contract alone, as the guide to the GDPR in student residences points out. Nor does paying for the stay of an adult resident give parents a right to receive information about them: that needs a basis of its own, usually the resident's consent. The AEPD lists data of children under fourteen among the risk criteria for an impact assessment.
Sources
Related terms
- GDPRThe GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
- ConsentConsent is a voluntary, specific, informed and unambiguous indication of a person's wishes by which they agree, through a statement or a clear affirmative action, to the processing of their data (art. 4.11 of the GDPR). It is one of the six legal bases, and the only one the data subject can withdraw at any time.