General authorisation concerning personal information of children
(1) The prohibition on processing personal information of children, as referred to in section 34, does not apply if the processing is— (a) carried out with the prior consent of a competent person; (b) necessary for the establishment, exercise or defence of a right or obligation in law; (c) necessary to comply with an obligation of international public law; (d) for historical, statistical or research purposes to the extent that— (i) the purpose serves a public interest and the processing is necessary for the purpose concerned; or (ii) it appears to be impossible or would involve a disproportionate effort to ask for consent, and sufficient guarantees are provided for to ensure that the processing does not adversely affect the individual privacy of the child to a disproportionate extent; or (e) of personal information which has deliberately been made public by the child with the consent of a competent person.
(2) The Regulator may, notwithstanding the prohibition referred to in section 34, but subject to subsection (3), upon application by a responsible party and by notice in the Gazette, authorise a responsible party to process the personal information of children if the processing is in the public interest and appropriate safeguards have been put in place to protect the personal information of the child.
(3) The Regulator may impose reasonable conditions in respect of any authorisation granted under subsection (2), including conditions with regard to how a responsible party must— (a) upon request of a competent person provide a reasonable means for that person to— (i) review the personal information processed; and (ii) refuse to permit its further processing; (b) provide notice— (i) regarding the nature of the personal information of children that is processed; (ii) how such information is processed; and (iii) regarding any further processing practices; (c) refrain from any action that is intended to encourage or persuade a child to disclose more personal information about him- or herself than is reasonably necessary given the purpose for which it is intended; and (d) establish and maintain reasonable procedures to protect the integrity and confidentiality of the personal information collected from children.
What this means for your estate
- For an estate, subsection (1)(a), “prior consent of a competent person”, is almost always the operative exception: a parent or guardian, not the child, has to consent before a minor's data is processed (added to a resident register, captured on a school-run access log, and so on).
- Subsection (3)(c) sets a specific, easy-to-violate standard for any child-facing form or system: it can't be designed to encourage a child to disclose more than reasonably necessary, worth checking against any online portal or sign-in kiosk children might use directly.
PopiGuard's Policy Vault includes a parental/guardian consent template built for subsection (1)(a), and flags child-facing forms against the subsection (3)(c) minimisation standard.