TIE Comments on the Guidelines on Consent (WP259) under Regulation 2016/679

Toy Industries of Europe (TIE) welcomes the opportunity to provide feedback on the Draft Guidelines on Consent under Regulation 2016/679 (GDPR). Overall, TIE supports the principle-based direction WP29 has taken in developing the Guidelines. We especially welcome the recognition of a proportionate approach to parental verification that differentiates between low-risk and high-risk processing in relation to children’s consent; this approach is essential to implement the Regulation in the real world. Nevertheless, the Guidelines also raise a number of questions on the implementation of the rules on children and consent that we would urge for clarification on. In particular:

Ensure a harmonised approach across the DSM to children and the GDPR

The section on Children’s Consent provides much needed guidance in this area, especially with regard to sites and services that are aimed at children.

We welcome the WP29 call for harmonised solutions with regard to age thresholds. We suggest that this call should go further: it should be applied to Article 8 as a whole, in order to ensure the rules on children are interpreted consistently across the Digital Single Market.

To provide additional certainty for business operating in multiple markets, we would also suggest that additional EU level Guidelines on the application of the GDPR in the context of children (as per the recently published draft UK Guidance) are needed to increase harmonised application of the rules. This would be especially helpful for those topics which the Guidelines leave to the discretion of the controller such as ‘reasonable effort’ and low vs. high risk processing.

We also think it is important that:

• Additional examples of a proportionate, risk-based approach to children’s consent are illustrated
• Further insight into the lawful grounds for processing children’s data is given
• More guidance on how to strike a balance between expiration of parental consent and data minimisation is given
• Services offered directly to a child are better differentiate
• Examples for withdrawing (parental) consent without detriment are provided

The full document can be downloaded here