Clause 8 of the Data Protection Bill provides that where consent is the lawful ground for processing data relating to the offer of information society services, children under 13 years old require parental consent or authority to consent.

The scope of the provision is limited to consent relating to the offer of information society services only.

Data Protection Bill HL Bill 66 Part 2 Chapter 2 clause 8 child’s consent in relation to information society services.

[Conditions applicable to child’s consent in relation to information society services (Article 8 General Data Protection Regulation (Regulation (EU) 2016/679))]

Article 8 GDPR sets out the conditions applicable to a child’s consent in relation to the offer of ‘information society services’ directly to a child.

Article 8(1) states that where Article 6(1)(a) GDPR (that processing shall be lawful only if the data subject has given consent to the processing of his or her personal data for one or more specific purposes) applies - in relation to the offer of information society services directly to a child - the processing shall only be lawful where that child is at least 16 years old.

Where a child is under 16, processing will only be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

Article 8(1) permits derogation from this rule and states:

Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.

The UK therefore has the option of setting the age at which a child may consent to the processing of their personal data by those offering information society services, to an age between 13 and 16.

Clause 8 of the Data Protection Bill gives effect to this derogation and sets the age threshold belo

w which parental consent is
required at 13 years old.