Are children’s data more sensitive?
In the eyes of the law, children’s data are not inherently more sensitive than adults’ data. However, it is important to remember that when data are processed based on consent, a child cannot give that consent themselves. Consent must be given by the child’s legal representative, either a parent or guardian.
For parents, however, the protection of children’s data may feel more sensitive than average, precisely because children are the weaker party. Parents have a duty to protect them in situations that may threaten the child’s safety and rights or lead to unpleasant consequences.
How should children’s data be requested, and do I have to share my child’s data?
We live in an information society where we have rights and obligations that require the use of certain services, such as compulsory education. To use these services, some data must inevitably be provided. The question is simply to what extent.
For example, how could a parent enrol their child in kindergarten without providing the child’s name or similar basic information? A less extreme example would be information about a child’s specific needs or special requirements.
A child may, for instance, have an allergy to nuts or bee venom, or a chronic health condition such as epilepsy. In the child’s interests, it is reasonable to inform the kindergarten about this. No childcare institution can or wants to take responsibility for consequences arising from a child’s specific needs if the parent has not considered it necessary to provide that information. In such a case, the institution could not take the need into account or provide the child with timely and necessary help.
Can an institution ask for an exact diagnosis when a child is absent, and where does common sense come in?
Health data are generally considered sensitive, or special category, personal data. Therefore, it is important to ensure adequate protection, following the principle of data minimisation where possible, using generalisation and avoiding identification, and applying measures such as anonymisation and pseudonymisation.
If an absence from school, for example due to a longer illness, must be confirmed with a medical certificate, the educational institution does not have the right to request specific information about the diagnosis.
At the same time, there are grey areas where common sense should be applied. Other kindergarten families will certainly appreciate it if a parent informs the kindergarten about contagious illnesses or similar issues, so that other parents can take preventive measures. Take chickenpox or head lice, for example; in such cases, minimal information that the child is simply ill may not be sufficient when considering the child’s young friends.
The staff of a childcare institution can presumably act professionally in such situations by disclosing the existence of a spreading contagious illness without identifying the specific child whose parent may have discovered it first.
May children be photographed and the images shared publicly on the institution’s social media or website?
Childcare and educational institutions regularly hold traditional events such as ceremonies, Christmas concerts, Mother’s Day concerts and similar gatherings. Since institutions such as kindergartens and schools are generally public institutions, their events are also considered public.
These events are often photographed or filmed to preserve pleasant memories in an image archive or to use visual material in the marketing of the educational institution.
Because such events may involve hundreds of parents, asking each person for separate consent may not be practical. A more resource-friendly solution may be to use a notice informing participants that children will be photographed. The notice should also explain the purpose and provide a reference, for example through a QR code, to the institution’s website or internal policy, where more detailed information is given about the legal basis for taking the photos and how they will be processed and stored.
This should also include information on whom to contact if a parent does not want photos of their child to be published.
A good practice is to provide information about photographing or filming together with the invitation, so that the people concerned can familiarise themselves with the privacy policy. In other words, the data protection terms, in advance.
The Estonian Data Protection Inspectorate has also recommended that, where possible, a separate area of the hall be designated for those who do not wish to be within camera range. In general, it is recommended that visual material be published in a way that does not make the child identifiable, for example by showing children from behind.
What should I do if I discover a photo of my child on a public website or in another parent’s post?
Parents often want to share the joy of their child singing, dancing or completing their first bicycle race with friends on social media. If other children are also visible in the image, it is proper and polite to ask the consent of the other affected parents before publishing it.
If a parent does not want a photo of their child to be online, and the child is identifiable, it is advisable to start by contacting the owner of the website or account and asking them to remove the image.
If that does not work, it is also possible to contact the supervisory authority, the Estonian Data Protection Inspectorate. However, the Inspectorate does not deal with claiming compensation, such as for reputational damage. That falls within the competence of the courts.
Are security cameras allowed in childcare and educational institutions?
The same rules apply here as in any other public place. The strict rule is that cameras are prohibited in rest areas, changing rooms, washing rooms and toilets.
The use of cameras may only be considered for preventing danger and ensuring security in places where people generally stay only briefly, such as entrances. For this purpose, a legitimate interest assessment must also be carried out. This assessment must answer whether the interest is legitimate or whether camera use should be abandoned.
What may a school publish: Olympiad and sports results, grades or alumni lists?
In general, results may be published based on consent or legitimate interest. First, the purpose of publication and the legal basis for processing must be clarified.
Possible purposes include recognising students and motivating one another. For example, a successful performance in an Olympiad may help with admission to upper secondary school or university, and marketing the educational institution, since schools also compete for academically stronger students.
Olympiads are usually competitions between schools. Therefore, broader public representation of the school is certainly relevant, and both consent and legitimate interest may be considered as legal bases. The same may apply to sports schools, for whom it is important to stand out through high athletic achievements.
Publishing internal school grades or results can generally be done on the basis of consent. As a general recommendation, the principle of minimisation should be followed. Would it be enough, for example, to publish only the top students, the top three or top ten, first names, an anonymised ranking, or results shared only with a narrower group?
The question is what purpose is served by presenting the weaker results at the bottom of a table. It is likely to make children who jumped one metre feel uncomfortable when the best students jumped five metres.
Publishing school alumni lists has also become a tradition, but this may be done on the basis of consent. A school may have an interest in publishing the names of alumni who later became publicly known high achievers. For example, a minister, scientist, Olympic winner or unicorn founder.
However, it is worth pointing out that the Estonian Data Protection Inspectorate does not recommend publishing full lists. Additional technical security measures should also be used, and such pages should be hidden from search engines.
When protecting children’s personal data, the starting point should above all be the interests of the child, the law and common sense. When processing personal data, the purpose must be clear, there must be a legal basis for processing, and the processing must be well thought through and justified.
Ask DataVie specialists for advice on how to prepare privacy policy or a legitimate interest assessment, or where to begin if you want to bring your institution’s or company’s activities into compliance with data protection requirements.
The article was originally published in Postimees