Recommendation 2: Encourage children to exercise their rights

What the law says

In France, it is the parents (or legal guardians) who, in principle, exercise the child's rights, in particular:

• the right of access, for finding out what data an organisation holds about the child;
• the right to rectification, i.e. the right to ask for certain inaccurate, outdated or incomplete information about the child to be corrected;
• the right to erasure, i.e. the possibility to request the deletion of the child's personal data
• the right to object, for refusing to allow some of the child's personal data to be used by an organisation for a given purpose.

However, various legal and practical arguments combine to allow children to exercise their rights directly in a number of situations

Indeed, the GDPR itself encourages them to do so. It says that children should be informed of their rights in a manner appropriate to their age and level of maturity. Provided they have understood them, logic dictates that they should also be able to exercise them. Similarly, the GDPR gives children the power to consent to certain types of processing of their personal data. It would be contradictory if they were then unable to exercise their rights over that processing, for example for data that they themselves have uploaded (e.g. photos on Instagram, videos on TikTok).

This reflects the entire philosophy of the French Data Protection Act. Indeed, Article 1 guarantees the right to informational self-determination, meaning that every person must be able to control their own data. This right is particularly relevant for young people who must learn to become conscious and responsible digital citizens, which certainly involves finding out about their rights and learning to exercise them.

More generally, the United Nations Convention on the Rights of the Child (UNCRC) recognises a child's right to privacy (art. 16) and to be heard (art. 12). These fundamental rights only have concrete and effective meaning if they give children a certain degree of power to ensure that they are respected, especially because it is sometimes their parents who are responsible for giving out their personal data in the first place. This is the stance taken by the recent UN General Comment on children's rights in relation to the digital environment (§72).

In fact in practice, allowing children to exercise their digital rights directly will respond to a real and urgent need concerning their digital autonomy, especially in view of the growing risk of cyberbullying.

Indeed, we need to give children the means to defend themselves, especially as it is unusual for them to turn to their parents when they encounter a problem online, for example if they want to get an embarrassing photo taken down .

The CNIL recognises that allowing children to exercise their rights is only a small part of the overall solution to the issue of cyberviolence, but it is nonetheless an important weapon for the protection for children and must be developed further.

Indeed, this proposal met with strong support during the public consultation conducted by the CNIL: 80% of contributors thought it was a good idea to allow children to exercise their own rights of access, rectification, erasure and objection.

Help and Guidance from the CNIL

Children may exercise their own rights directly in relation to their personal data, provided this can be regarded as a "routine act" and especially if it is in the best interests of the child. The CNIL therefore believes that children should be able to exercise their own personal data rights on social networks, gaming and video sharing platforms.

This ability to act autonomously does not override the parents' power to exercise those same rights on behalf of their child and to provide support during the process.

In order to help ensuring that all these rights are exercised effectively, the CNIL recommends that online service providers take every possible measure to explain the process and the legal remedies available, in a clear and comprehensible manner.