No Nut November

What about Destroy Dick December?

The General Data Protection Regulation (GDPR) came into force across the European Union on 25 May 2018. This update of the mapping of the implementation of article 8 GDPR reflects the most recent decisions that have been made in relation to the age of consent in the 28 EU Member States. In quite a number of countries, these decisions might still be subject to further changes in the coming weeks and months.

Article 8 of the General Data Protection Regulation (GDPR) contains specific requirements regarding consent for the processing of personal data of children. The general rule provides for a parental consent requirement for all youth under 16 years old in situations where information society services are offered directly to them, and consent is the legitimation ground that is relied upon.1 However, Member States may choose to deviate and decide to lower the age threshold to 15, 14, or 13 years. In preparation for the implementation of the GDPR, national (draft) implementation acts, national consultations or guidance by Data Protection Authorities (DPAs) have been published across the EU. Although still in quite some countries no final decisions have been taken, our research into national approaches, based on official and public documents, shows that the implementation of article 8 is fragmented across the EU. 

Since the last update of the mapping in May 2018, several developments occurred in Belgium, Bulgaria, France and Portugal. The final national GDPR implementation laws were adopted in Denmark, Sweden, the Netherlands and the United Kingdom. Notably, Ireland and Italy have changed their initial decisions. Norway and Switzerland, members of the European Economic Area and the European Free Trade Association respectively, have also proposed new data protection laws.

Congress enacted the Children’s Online Privacy Protection Act (COPPA) in 1998.  COPPA required the Federal Trade Commission to issue and enforce regulations concerning children’s online privacy.  The Commission’s original COPPA Rule became effective on April 21, 2000.  The Commission issued an amended Rule on December 19, 2012.  The amended Rule took effect on July 1, 2013.
 
The primary goal of COPPA is to place parents in control over what information is collected from their young children online.  The Rule was designed to protect children under age 13 while accounting for the dynamic nature of the Internet.  The Rule applies to operators of commercial websites and online services (including mobile apps) directed to children under 13 that collect, use, or disclose personal information from children, and operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13.  The Rule also applies to websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children. Operators covered by the Rule must:

1. Post a clear and comprehensive online privacy policy describing their information practices for personal information collected online from children;
   
2. Provide direct notice to parents and obtain verifiable parental consent, with limited exceptions, before collecting personal information online from children;
   
3. Give parents the choice of consenting to the operator’s collection and internal use of a child’s information, but prohibiting the operator from disclosing that information to third parties (unless disclosure is integral to the site or service, in which case, this must be made clear to parents);
   
4. Provide parents access to their child's personal information to review and/or have the information deleted;
   
5. Give parents the opportunity to prevent further use or online collection of a child's personal information;
   
6. Maintain the confidentiality, security, and integrity of information they collect from children, including by taking reasonable steps to release such information only to parties capable of maintaining its confidentiality and security; and
   
7. Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the  information using reasonable measures to protect against its unauthorized access or use.