Certain Legal Aspects of Children's Right to Protect Personal Data in the Context of AI under the European Union Data Protection Laws

The European Union (EU) legal system provides children with the fundamental right to have their data protected within the ambit of its data protection laws. Article 8 of the Charter of the Fundamental Rights of the EU provides the right for everyone’s personal data to be protected, including children. Similarly, Council of Europe (CoE) Convention 108 protects anyone’s data in both automatic and non-automatic processing environments.

Children are the most active online user group. Therefore, the protection of children’s data is necessary to protect them from related risks and harms. The rationale for providing special protection is that they are less aware of the risks, consequences, safeguards, and rights. The typologies of privacy harms highlight that data subjects lose control over their data in all incidents of personal data compromise. The phenomenon could lead to physical, economic, reputational, psychological, and autonomic harms, breaches of professional secrecy, other social disadvantages, and material and non-material damage such as discrimination, identity theft, fraud, etc. The risks of harm are greater in the artificial intelligence (AI) context. Virtual reality technologies used for gaming purposes, advertising technologies such as Adtech technologies, various Internet of Things (IoT) technologies embedded in smart toys, deploying analytics to derive results from their data, pushing personalised content, etc. are some examples of AI deployment which can process children’s data unlawfully online. Therefore, protecting children from unlawful use of their data online in the AI context is obligatory.

Analysing the EU data protection laws in the AI context unfolds certain legal aspects such as default processing situations, the best interests of children, processing based on children’s consent and contract, processing based on the transparency principle, automatic decision-making based on children’s data and the responsibility of stakeholders to protect children’s data. Collectively, they reveal serious shortcomings of law in the area, which may require regulating the area with an exclusive law.