Abstract
Draft regulatory guidance suggests that if the processing of a child’s personal data begins with the consent of a parent, then there is a need to find and defend an enduring consent through the child’s growing capacity and on to their maturity. We consider the implications for health research of the UK Information Commissioner’s Office’s (ICO) suggestion that the relevant test for maturity is the Gillick test, originally developed in the context of medical treatment. Noting the significance of the welfare principle to this test, we examine the implications for the responsibilities of a parent to act as proxy for their child. We argue, contrary to draft ICO guidance, that a data controller might legitimately continue to rely upon parental consent as a legal basis for processing after a child is old enough to provide her own consent. Nevertheless, we conclude that data controllers should develop strategies to seek fresh consent from children as soon as practicable after the data controller has reason to believe they are mature enough to consent independently. Techniques for effective communication, recommended to address challenges associated with Big Data analytics, might have a role here in addressing the dynamic relationship between data subject and processing. Ultimately, we suggest that fair and lawful processing of a child’s data will be dependent upon data controllers taking seriously the truism that consent is ongoing, rather than a one-time event: the core associated responsibility is to continue to communicate with a data subject regarding the processing of personal data.
Highlights
Does consent obtained from a parent for use of a child’s personal data for health research ‘lapse’ when the child is old enough to provide her own consent? If so, when does that lapse occur, how is it to be determined, and with what consequences? Somewhat surprisingly, despite the increasing use of personal data from adults and children alike for health research, hitherto these questions have not been addressed in the literature or as a matter of data protection law
We focus our thoughts on the implications for health research of recognising a mature minor to be able to exercise the rights of a data subject on her own behalf
While we choose this as our focal point, we note that the regulator’s suggestion that the Gillick test has something to offer data protection law is not limited to [the context of] healthcare, research, or health research
Summary
Does consent obtained from a parent for use of a child’s personal data for health research ‘lapse’ when the child is old enough to provide her own consent? If so, when does that lapse occur, how is it to be determined, and with what consequences? Somewhat surprisingly, despite the increasing use of personal data from adults and children alike for health research, hitherto these questions have not been addressed in the literature or as a matter of data protection law. We centre our analysis on the implications for the kind of longitudinal research that begins with a parental consent and continues for many years While we choose this as our focal point, we note that the regulator’s suggestion that the Gillick test has something to offer data protection law is not limited to [the context of] healthcare, research, or health research. Irrespective of the issue of when maturity is achieved, it remains unclear whether the ICO’s intention is to suggest that the validity of any consent provided by a parent lapses as soon as a data subject is able to exercise rights on her own behalf If so, this would seem to be inconsistent with other guidance offered by data protection authorities as well as the operation of the Gillick test itself in the healthcare context, which recognises autonomy in ways that are themselves highly context-specific. It is a pre-requisite for explanation to a data subject, and her parents, of her right to speak for herself
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Free) 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call
