*This is an AI-powered machine translation of the original text in Portuguese

LGPD AND CHILDREN: ONLY CONSENT, REALLY?

The "datification" of society also affects children, who are especially vulnerable to the exposure of personal information. In the report "Children's Data and Privacy Online" by the London School of Economics, children's privacy is divided into three segments: interpersonal (the creation of minors' digital footprint), institutional (how the government and its affiliated agencies handle children's data), and commercial (how children's data is used by companies and for marketing purposes).

With the consolidation of data protection laws worldwide, various debates have emerged, including those related to the appropriate safeguards for the processing of children's data by companies. The LGPD (Lei nº 13.709/2018) in Brazil is no exception, but there is still a certain gap regarding this type of treatment.

In Europe, in countries regulated by the GDPR, companies can use legitimate interest as a legal basis for processing children's data, as long as they exercise special care in balancing rights. Therefore, it is observed that while European data protection legislation is permissive, Brazilian legislation tends to be more protective of children.

The LGPD's rules regarding the processing of children's data are summarized in Article 14 and its six paragraphs. Article 14(1) of the LGPD is the legal basis for adopting consent as the general rule for the processing of children's data, limiting other scenarios.

"Article 14(1) Personal data processing of children shall be carried out with specific and highlighted consent given by at least one of the parents or the legal guardian."

The following paragraphs govern how this consent should be obtained and cases in which it may be waived. This choice is in line with other decisions made by the Brazilian legislator, such as restricting child advertising, a scenario in which companies would notably want to use legitimate interest as the legal basis for processing. But should consent alone apply to children's data in all situations?

Consent as a Rule and Its Exceptions It is uncontroversial that children's interests must be especially protected. However, the special protection of children goes beyond the 300 words discussed on this topic in the LGPD. This is not only due to the clear brevity of the LGPD's approach to this issue but also to the explanations provided by the Special Committee.

When discussing Article 14, the Special Committee makes it clear that its inspiration comes from COPPA (Children's Online Privacy Protection Act), American legislation aimed at protecting children in the online world, suggesting this universe as the ideal scope of application for what is regulated in the LGPD.

The Committee also highlights the connection in the LGPD between using consent for children's data and the verifiability of this consent in the online world. Furthermore, the text of the law itself, as will be seen below, reinforces the need to view the processing of children's data beyond the text of Article 14.

The first rule that Article 14 of the LGPD brings is that the processing of children's data should always be done in their best interest. However, as acknowledged by the Special Committee responsible for the opinion on the LGPD bill, this rule alone would be superficial and would not provide "any special protection for this vulnerable group of people."

Thus, alongside the best interests of the child, which must always be considered, Article 14's main clause explicitly mentions two hypotheses for processing children's data: the "terms of this article" - which are the rules specific to the relevant article of the LGPD - and the "terms of the relevant legislation."

THE TERMS OF THIS ARTICLE

The terms of Article 14 center around parental or legal guardian consent for the processing of a child's data, as determined by paragraph 1. The same article includes important exceptions to this consent requirement, such as in paragraph 3, which allows for the processing of children's data when necessary to contact their parents (or legal guardians) or to protect them. See:

"Paragraph 3. Personal data of children may be collected without the consent referred to in paragraph 1 of this article when the collection is necessary to contact the parents or legal guardian, used only once and without storage, or for their protection, and in no case may be passed on to third parties without the consent referred to in paragraph 1 of this article."

In this paragraph, the LGPD recognizes that the best interests of the child may not always be represented by the will of their parents or legal guardians, as there may be situations where this interest goes beyond their legal representatives' decisions. In the scenarios presented in paragraph 3, obtaining consent may be impossible. In cases of physical separation between the child and parents or legal guardians, it would be unreasonable to require data processing exclusively based on consent.

In cases of child protection, there is also the possibility that data processing must be carried out despite the parents' wishes or even against their wishes. This is because the child's best interest may not align with the wishes expressed by their parents, either due to a lack of awareness of the need for protection or due to malicious intent.

With a view to protecting children, one can even envision the applicability of at least two legal bases not mentioned in Article 14: the protection of health and the protection of life or physical integrity. Although not explicitly included in the article, both scenarios align with the concept of "protection" of the child, serving as an authorizing reason for data processing without consent.

THE TERMS OF THE RELEVANT LEGISLATION

The second hypothesis in the main clause can be interpreted in two ways. First, as an indication that the LGPD's rules should be interpreted in harmony with other specific laws, notably the Child and Adolescent Statute and the Civil Code.

This implies, for example, reaching interpretative conclusions that do not contradict these laws. Second, it can be interpreted as a broader opening in the LGPD for children's data to be processed based on the fulfillment of legal or regulatory obligations or the regular exercise of rights, as long as these obligations and rights are relevant.

"Article 14. The processing of personal data of children and adolescents shall be carried out in their best interest, under the terms of this article and the relevant legislation."

Before delving further into this issue, it should be emphasized that regardless of the interpretation adopted, the processing of children's data cannot be limited to consent and the few exceptions provided in the LGPD.

A different interpretation would create distortions in legal and regulatory obligations, such as reporting in the education system, epidemiological information, among others, which would be subject to the parents' wishes. For example, early childhood education schools would be subject to parental consent (which can be revoked) to process student data to maintain records of children's development, which is a legal obligation under Law No. 12,796/2013.

The same could occur in healthcare services, which have a legal obligation to report cases (suspected or confirmed) of certain diseases to health authorities, according to Law No. 6,259/75. Violating this duty by a physician is even a criminal offense under Article 269 of the Penal Code. In this regard, a harmonizing interpretation of the norms leads us to conclude that these legal obligations can (and should) be fulfilled without the need for consent.

Furthermore, there are other gaps caused by a restrictive interpretation of Article 14. For example, an (unacceptable) impossibility of processing children's data for the regular exercise of rights in a judicial, administrative, or arbitration process. For example, in the case of a dispute between a data controller and the parents of a child. If parental consent is the only legal basis, this would prevent the data controller from producing evidence using data related to the child.

Even if such data is in their possession, the LGPD guarantees the right to delete data processed with consent, regardless of justification. This could lead to improper manipulation of documents. While Article 16 lists scenarios where the deletion of personal data may be refused, the regular exercise of rights is not one of them. These scenarios encompass only: compliance with a legal obligation, research by a research organization, transfer to a third party, and exclusive use by the controller as long as the data is anonymized.

CONCLUSION

The processing of children's data can and should largely be based on parental and legal guardian consent. However, this hypothesis should not blind data controllers to situations where processing data based on consent would be ill-advised or even unfeasible.

What data protection laws should aim for when safeguarding children's information is the prevention of abuse, which is more easily established when the data subjects are vulnerable. However, this should not imply the prevention of processing children's data in different situations, as long as it is in their best interest.

Legal bases provided in the LGPD, such as health protection, protection of life and physical integrity, legal or regulatory obligations, and the regular exercise of rights, may be compatible with this best interest in certain scenarios. Failing to recognize them can lead to serious distortions in the system of legal and regulatory obligations and potentially harm the well-being of the minors that these laws intend to protect.

^[1] London School of Economics, Information Commissioner’s Office. Children’s data and privacy online. Dezembro de 2018. Disponível em: <https://www.lse.ac.uk/media-and-communications/assets/documents/research/projects/childrens-privacy-online/Evidence-review-final.pdf>.

^[2] Comissão Especial Destinada a Proferir Parecer ao Projeto de Lei No. 4060, de 2012, pp. 36–37. Disponível em: <https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1663305&filename=>.

^[3] Comissão Especial Destinada a Proferir Parecer ao Projeto de Lei No. 4060, de 2012, p. 36. Disponível em: <https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=1663305&filename=>.