15. Online tools

What do you mean by ‘online tools’?

Online tools are mechanisms to help children exercise their rights simply and easily when they are online. They can be used to help children exercise their right to access a copy of their personal data, or to make a complaint or exercise any of their remedial rights.

Why is this important?

The GDPR gives data subjects the following rights over their personal data in articles 15 to 22:

• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling

Recital 65 states that the right to erasure has particular relevance for children using online services:

“...that right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet…”

Article 12 of the GDPR provides that:

“12(1) The controller shall take appropriate measures to provide ……… any communication under Articles 15 to 22 ….. relating to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing or by other means, including where appropriate by electronic means…..

(2) The controller shall facilitate the exercise of data subject rights under Articles 15 to 22…….

(3) The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by a further two months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.”

In order to comply with these provisions you need to find ways to make sure that children know about their rights and are able to easily exercise them. You have an obligation not just to allow children to exercise their rights but to help them to do so.

How can we make sure that we meet this standard?

In order for children to exercise their rights they firstly need to know that these rights exist and what they are.

Make your tools prominent

The tools which you provide to help children exercise their rights and report concerns to you must be easy for the child to find. You therefore need to give them prominence on your online service. You should highlight the reporting tool in your set up process and provide a clear and easily identifiable icon or other access mechanism in a prominent place on the screen display.

If your online service includes a physical product, for example a connected toy or speaker, you can include the icon on your packaging, highlighting online reporting tools as a product feature, and find ways to highlight reporting tools in a prominent way even if the product is not screen-based.

Make them age appropriate and easy to use

Your tools should be age appropriate and easy to use. You should therefore tailor them to the age of the child in question. The following table provides some guidelines. However, these are only a starting point and you are free to develop your own, service specific, user journeys that follow the principle in the headline standard.

You should also consider any additional responsibilities you may have under the applicable equality legislation for England, Scotland, Wales and Northern Ireland.

Make your tools specific to the rights they support

You should tailor your tools to support the rights children have under the GDPR. For example:

• a ‘download all my data’ tool to support the right of access, and right to data portability;
• a ‘delete all my data’ or ‘select data for deletion’ tool to support the right to erasure;
• a ‘stop using my data’ tool to support the rights to restrict or object to processing; and
• a ‘correction’ tool to support the right to rectification.

Used together with privacy setting such tools should help to give children control over their personal data.

Include mechanisms for tracking progress and communicating with you

Your online tools can include ways for the child or their parent to track the progress of their complaint or request, and communicate with you about what is happening.

You should provide information about your timescales for responding to requests from children to exercise their rights, and should deal with all requests within the timescales set out at Article 12(3) of the GDPR.

You should have mechanisms for children to indicate that they think their complaint or request is urgent and why, and you should actively consider any information they provide in this respect and prioritise accordingly. You should have procedures in place to take swift action where information is provided indicating there is an ongoing safeguarding issue.