Mr. Dale Sunderland:

I thank Senator Boyhan for his questions. The Senator raises an important point. It is tangentially addressed in this proposed Bill on the registration of pending electors.

To give the Senator some brief background, late last year the Data Protection Commission published draft guidance around the protection of children's personal data - Children Front and Centre: Fundamentals for a Child-Oriented Approach to Data Processing. That is out for public consultation at present until the end of this month. In large part, it looks at online platforms, as one would expect given that we are the lead supervisory authority for many of the giant technology firms, but in all contexts of the processing of children it sets down fundamental requirements. The General Data Protection Regulation, GDPR, calls out children as a special subset of individuals which deserve the highest protections of standards of data protection and we acknowledge in our guidance that under the age of 18 is the age at which a person is determined as a child in line with the definition of a child under the UN Convention on Human Rights of the Child. Given that the registration of pending electors will involve the crossing of personal data of children, that is, persons under the age of 18, we advised, as the Senator states, the Department that it should consider our draft guidance and to look and see which elements of that might apply.

Of particular relevance to this registration process is a recommendation that in implementing the legislation there would be an audience-aware approach to the provision of clear and targeted information. The legislation, in a sense, probably is what it is. It is a question as to whether further evolving of that in the drafting is required but what is of critical importance will be the implementation of that provision. I understand, from the heads of the Bill, that the registration of pending electors would be done on the basis of applications by maybe 16-year-olds or 17-year-olds, and that the Department has talked about running certain programmes to involve children in the electoral process to get them engaged. Those are all public policy imperatives, but what we are calling out is that one must remember where the processing of personal data arises that one is dealing with children and, therefore, the information should be targeted in a way that is appropriate to their age. It applies to adults, but most particularly applies to children, and must be concise, transparent, intelligible and accessible.

It is also to make the point as well that we suggested a data protection impact assessment - I mention it again - should be carried out for this specific cohort of persons and address any additional safeguards that might be needed. I do not have a deep insight into what they might be at this stage other than, I suppose, a general warning that when one is processing specifically the personal data of children it is important that any risk to their rights is identified and addressed.

Further on, there is also potentially the issue of their rights under the GDPR and the different rights that may apply, such as the right of access. In the implementation of these provisions there would need to be deep thought around how that would apply because, in some cases, parents may, for example, submit an access request on behalf of a child. At that age, the child has probably reached an age of maturity where he or she should be able to exercise his or her own data protection rights, but it is a sliding scale. I am probably going a little off point.

Our core point in raising that was that the Department would be aware it will be processing children's data in a specific context, albeit at the request of the child. The core issue for us is around the transparency of the information to the cohort of people, clearly explaining what it means to engage in this way of putting one's details on the electoral register before one turns 18. I will say straight up that there may not be extensive risks but it is important that there be a specific focus on the matter to identify and mitigate any risks that are there to the rights of the children.