Our previous blog here sets out what a data subject access request (DSAR) is. This blog answers the question as to whether it is possible for a child to make a DSAR for his/her personal data. In short, the answer is yes.
There is no fixed/minimum age for a DSAR to be made independently. Children have the same rights as adults over their personal data. The right to make a DSAR generally depends on the child’s capacity to understand his/her rights and the implications of making such a request. The organisation receiving the request must assess whether the minor has sufficient maturity to understand the nature of the request. There is no presumption in England and Wales about sufficient age or maturity to be able to exercise the child’s data protection rights. The child should not be considered to be competent if he/she is obviously acting against his/her best interests. If the minor lacks the capacity to make the request, a parent, guardian or adult with parental responsibility may act on his/her behalf. If the organisation is satisfied that the child is competent, it should respond to the DSAR directly to the child or the parent who made it on behalf of the child if the child authorises this.
When making the above assessment, according to the Information Commissioner’s Office, the organisation should take the following matters into consideration:-
- The child’s level of maturity and their ability to make decisions like this;
- The nature of the personal data;
- Any court orders relating to parental access or responsibility that may apply;
- Any duty of confidence owed to the child or young person;
- Any consequences of allowing those with parental responsibility access to exercise the child’s rights. This is particularly important if there have been allegations of abuse or ill treatment;
- Any detriment to the child or young person if individuals with parental responsibility cannot access this information; and
- Any views the child or young person has on whether their parents should have access to information about them.
There are certain types of sensitive data that may not be disclosed to the parent. For example, if the data concerns child abuse or health information, disclosure may be restricted if it is not in the best interests of the child or if the child provided the information with an expectation of confidentiality.
How can we help?
Ronny Tang is an Associate in our expert Dispute Resolution team, specialising in defamation claims, contentious probate
and inheritance claims, Trusts of Land and Appointment of Trustees Act 1996 claims, Equality Act 2010 claims and Protection From Harassment 1997 claims.
If you have any questions concerning the above related subject, please contact Kate, Ronny or another member of the team in Derby, Leicester, or Nottingham on 0800 024 1976 or via our online enquiry form.
Contact us