Recommendation 2: Encourage children to exercise their rights
There are several legal and practical reasons why children should be allowed to exercise their own digital rights.
I don't know which button to press.
What the law says
In France, it is the parents (or legal guardians) who, in principle, exercise the child's rights, in particular:
- the right of access, for finding out what data an organisation holds about the child;
- the right to rectification, i.e. the right to ask for certain inaccurate, outdated or incomplete information about the child to be corrected;
- the right to erasure, i.e. the possibility to request the deletion of the child's personal data
- the right to object, for refusing to allow some of the child's personal data to be used by an organisation for a given purpose.
However, various legal and practical arguments combine to allow children to exercise their rights directly in a number of situations
Indeed, the GDPR itself encourages them to do so. It says that children should be informed of their rights in a manner appropriate to their age and level of maturity. Provided they have understood them, logic dictates that they should also be able to exercise them. Similarly, the GDPR gives children the power to consent to certain types of processing of their personal data. It would be contradictory if they were then unable to exercise their rights over that processing, for example for data that they themselves have uploaded (e.g. photos on Instagram, videos on TikTok).
This reflects the entire philosophy of the French Data Protection Act. Indeed, Article 1 guarantees the right to informational self-determination, meaning that every person must be able to control their own data. This right is particularly relevant for young people who must learn to become conscious and responsible digital citizens, which certainly involves finding out about their rights and learning to exercise them.
More generally, the United Nations Convention on the Rights of the Child (UNCRC) recognises a child's right to privacy (art. 16) and to be heard (art. 12). These fundamental rights only have concrete and effective meaning if they give children a certain degree of power to ensure that they are respected, especially because it is sometimes their parents who are responsible for giving out their personal data in the first place. This is the stance taken by the recent UN General Comment on children's rights in relation to the digital environment (§72).
In fact in practice, allowing children to exercise their digital rights directly will respond to a real and urgent need concerning their digital autonomy, especially in view of the growing risk of cyberbullying.
Indeed, we need to give children the means to defend themselves, especially as it is unusual for them to turn to their parents when they encounter a problem online, for example if they want to get an embarrassing photo taken down .
of children have experienced cyberviolence, and 7% have experienced cyberbullying.
of children who are cyberbullied tell their parents about it.
(Source - in French: association E-enfance)
The CNIL recognises that allowing children to exercise their rights is only a small part of the overall solution to the issue of cyberviolence, but it is nonetheless an important weapon for the protection for children and must be developed further.
Indeed, this proposal met with strong support during the public consultation conducted by the CNIL: 80% of contributors thought it was a good idea to allow children to exercise their own rights of access, rectification, erasure and objection.
Help and Guidance from the CNIL
Children may exercise their own rights directly in relation to their personal data, provided this can be regarded as a "routine act" and especially if it is in the best interests of the child. The CNIL therefore believes that children should be able to exercise their own personal data rights on social networks, gaming and video sharing platforms.
This ability to act autonomously does not override the parents' power to exercise those same rights on behalf of their child and to provide support during the process.
In order to help ensuring that all these rights are exercised effectively, the CNIL recommends that online service providers take every possible measure to explain the process and the legal remedies available, in a clear and comprehensible manner.
Discover the 8 recommendations from the CNIL
1 - Regulate the capacity of children to act online
2 - Encourage children to exercise their rights
3 - Support parents with digital education
4 - Seek parental consent for children under 15
5 - Promote parental controls that respect the child's privacy and best interests
6 - Strengthen the information and rights of children by design
7 - Check the age of the child and parental consent while respecting the child's privacy
8 - Provide specific safeguards to protect the interests of the child