Ms Anna Morgan:

On a digital safety commissioner, we have noted that a public consultation process has been launched by the Government and is ongoing. The consultation concerns the bringing into effect of legislation on online safety. The legislation is also intended to transpose the EU's audiovisual media services directive. Insofar as there is an intersection between data protection and issues of online safety, it occurs in relation to children in particular. Data protection authorities have a newly enunciated obligation under article 57 of the GDPR to drive awareness of issues relating to children's rights and the risks for them in the processing of their data by organisations.

We have been exploring this issue during the course of 2018 to try to identify methods by which we could better raise awareness and drive good practices among organisations, particularly in the online sector. With a view to doing that, as I referred to in my opening statement, we launched a consultation process at the end of 2018 which has two limbs to it. The first is a written public consultation aimed at adult stakeholders. Parents, educators, child protection organisations and children's representative groups are all encouraged to take part in this consultation, which engages a range of issues from transparency information to children to enable them to understand what is happening to their data when they engage in the context of online platforms and apps. It also covers issues such as the appropriate age at which a child should be able to exercise his or her data protection rights because the GDPR is silent on that issue. However we are conscious of the UN Convention on the Rights of the Child and the particular provisions that relate to children having a right to have a say, in light of their evolving capacities, on matters that directly concern them.

The consultation also relates to issues around direct marketing and advertising to children and the use of children's data in that context. Along with topical issues, of which the committee members will be aware, it relates to Article 8 of the GDPR concerning the age of digital consent and issues around age verification, including the verification obligations on online organisations to establish that consent to processing has been given by the holder of parental authority. In light of all of these issues, which have been to the fore of public discussion in the past two years, we launched this consultation process. We were also very keen to engage with children directly. For this reason, we made the unique decision to launch a further stream of our consultation, this one aimed at garnering the views of children in particular. We explored different methods by which we could more effectively do that and we decided that participation in a standard written consultation was potentially not the most effective way to gather children's views. For this reason, in 2018 we designed a series of lessons plans from scratch, which aims to educate children in a classroom setting on basic principles of data protection to make them aware of their rights and the risks when they are sharing information in an online setting. These education materials have been sent to every school and all of the Youthreach centres.

The timeframe for the consultation is still ongoing. We have asked teachers in schools to participate, obviously on a voluntary basis, in delivering those lesson plans. The ultimate output of those lesson plans is an exercise whereby teachers can gather the views of children on the topics that have been discussed. They can also share their opinions on issues such as the age at which children should be able to make an access request to an organisation or seek the erasure of data they have shared online. That consultation is ongoing and at the end of the process, the intention is to produce best practice guidance for organisations on the use of children's data and, importantly, guidance for children which will be written in accessible and easy to understand language to help them to better comprehend the issues around sharing information online. Connected to that and in light of our obligation, as set out in the 2018 Act, to encourage the drawing up of codes of practice by industry on a range of issues concerning the processing of children's data, we also aim to use the outputs of that consultation to encourage industry members to come together and produce those codes of conduct.