The Privacy Act 2020 amended information privacy principle (IPP) 4(b) to require agencies collecting personal information from children or young persons to take particular care to ensure the collection is fair and proportionate. This change reflects overseas approaches, recognising that children may be less aware of the risks involved in providing information, especially online, and should be given additional protection. It requires agencies todesign their collection systems and processes with this goal in mind.
What is meant by ‘children or young persons’?
- ‘Children or young persons’ is not defined in the Privacy Act. A sensible position would be to treatanyone under the age of eighteen as a child or a young person for the purpose of IPP4.
- The age of the target individual will inform the design of the collection process. For example, a collection of information from primary school aged children will require a different approach to a collection of information from school leavers.
- Remember, children have the same rights under the Privacy Act as anyone else.
- While the amendment to IPP4 relates only to ‘children and young persons’ it is worth considering whether you may be collecting personal information from other vulnerable groups, who should also have their needs considered to ensure any collection is fair and proportionate.
Being respectful and honest
- An agency must be fair in the way that it collects personal information about children. Fairness is about recognising imbalances of power and about being honest and meaningfully transparent.
- There will always be an imbalance of power between an agency and any vulnerable group, including children, who may be less able to challenge a collection. You must take steps to ensure that you take into account this imbalance of power when deciding how to collect personal information.
- You must be honest – with the relevant child or a third party – about why you need information and how you will use it. Deliberately mis-stating the purpose for collection or exaggerating the consequences of not providing the information will never be considered fair.
Being clear and open
- Fairness requires transparency, which links to an agency’s obligations under IPP3 to make children or their representatives aware at the point of collection how their personal information will be used, including who it might be shared with, and what rights the child has over that information.
Collecting personal information from children
- But this transparency also needs to be meaningful. You must take into account the age of the child by presenting this information clearly and in an age-appropriate way, so that the child is able to understand the consequences of providing (or not providing) the requested information without needing an adult to help them.
- You should use simple, non-technical language, and keep things short and snappy. The use of child friendly methods such as icons or pictures, cartoons or short videos can be effective.
- If personal information is being collected from both children and adults then consider the use of layered privacy statements or collection notices, which provide a high-level statement that can be understood by all ages, and access to more detailed information if desired (for example, via links on a website).
Being reasonable and proportionate
- As well as beng fair, agencies need to make sure that the way they are collecting personal information from children is not unreasonably intrusive in the circumstances. This is about being proportionate, and thinking about whether the ends justify the means.
- This links closely to the requirement in IPP1 to make sure an agency only collects the personal information it needs; IPP4 builds on this by requiring the agency to collect this information in ways that are not more intrusive than they need to be.
- This also requires you to think about the physical circumstances of the collection. For example, the collection of sensitive personal information from a child in a public place – such as the classroom – may be unreasonably intrusive in some cases.
- Ask yourself whether the personal information you need could be collected from the child using another, less intrusive method.
Taking a privacy by design approach
- Design the above considerations into your change processes. For example, include in your privacy by design/Privacy Impact Assessment processes questions or requirements that will identify if personal information may be collected from children, and if so, what needs to be considered.
- Consider taking the views of children and young persons into account when designing a new or changed process by seeking their input.