2.2 Minors
Article 8 of the GDPR provides for special conditions regarding child’s consent in
relation to information society services. As noted in the Preamble, such specific
protection applies, in particular, to the use of personal data for the purposes of
marketing or creating personality or user profiles of children and the collection of
personal data when using services offered directly to a child (Recital 38). Where
processing is based on the consent given by the data subject, the processing of data
of children below the age of 16 years is only deemed lawful to the extent that consent
is given or authorised by the holder of parental responsibility over the child. Member
States are granted certain discretion in this regard, since they may provide by law for
a lower age provided that it is not below 13 years. Furthermore, in those situations
controllers are under a “reasonable efforts” obligation to verify that consent is given
by the holder of parental responsibility over the child, taking into consideration
available technology.
2.3 Right to Erasure and Right to Object
Article 17 of the GDPR is devoted to the right to erasure, also known as the ‘right to
be forgotten’, which was admitted under Directive 95/46/EC by the CJEU in its
landmark judgment in the Google Spain case.
22 Data subjects are granted the right to
obtain from the controller the erasure of personal data concerning him or her without
undue delay where one of the following grounds applies: data are no longer
necessary in relation to the purposes for which they were collected or processed;
the data subject withdraws consent on which the processing is based and there is no
other legal ground for the processing; the data subject objects to the processing of the
data and there are no overriding legitimate grounds for the processing; the data have
been unlawfully processed; the data have to be erased for compliance with a legal
obligation to which the controller is subject; the data have been collected in relation
to the offer of information society services directly to a child.
However, the obligation of the controller to erase the personal data does not apply
to the extent that processing is necessary for any of the grounds listed in Article
17 GDPR. Such grounds include: exercising the right of freedom of expression and
information; for compliance with a legal obligation or for the performance of a task
carried out in the public interest or in the exercise of official authority; for reasons of
public interest in the area of public health; for archiving purposes in the public
22 CJEU Judgment of 13 May 2014, case C-131/12, Google Spain SL and Google Inc. v. Agencia
Española de Protección de Datos (AEPD) and Mario Costeja González, ECLI:EU:C:2014:317. See
Article 29 Working Party on Data Protection, “Guidelines on the Implementation of the CJEU
Judgment on “Google Spain and Inc v. Agencia Española de Protección de Datos (AEPD) and
Mario Costeja González” C-131/12”, 26 November 2014.
464
P. A. de Miguel Asensio
Article 8 of the GDPR provides for special conditions regarding child’s consent in
relation to information society services. As noted in the Preamble, such specific
protection applies, in particular, to the use of personal data for the purposes of
marketing or creating personality or user profiles of children and the collection of
personal data when using services offered directly to a child (Recital 38). Where
processing is based on the consent given by the data subject, the processing of data
of children below the age of 16 years is only deemed lawful to the extent that consent
is given or authorised by the holder of parental responsibility over the child. Member
States are granted certain discretion in this regard, since they may provide by law for
a lower age provided that it is not below 13 years. Furthermore, in those situations
controllers are under a “reasonable efforts” obligation to verify that consent is given
by the holder of parental responsibility over the child, taking into consideration
available technology.
2.3 Right to Erasure and Right to Object
Article 17 of the GDPR is devoted to the right to erasure, also known as the ‘right to
be forgotten’, which was admitted under Directive 95/46/EC by the CJEU in its
landmark judgment in the Google Spain case.
22 Data subjects are granted the right to
obtain from the controller the erasure of personal data concerning him or her without
undue delay where one of the following grounds applies: data are no longer
necessary in relation to the purposes for which they were collected or processed;
the data subject withdraws consent on which the processing is based and there is no
other legal ground for the processing; the data subject objects to the processing of the
data and there are no overriding legitimate grounds for the processing; the data have
been unlawfully processed; the data have to be erased for compliance with a legal
obligation to which the controller is subject; the data have been collected in relation
to the offer of information society services directly to a child.
However, the obligation of the controller to erase the personal data does not apply
to the extent that processing is necessary for any of the grounds listed in Article
17 GDPR. Such grounds include: exercising the right of freedom of expression and
information; for compliance with a legal obligation or for the performance of a task
carried out in the public interest or in the exercise of official authority; for reasons of
public interest in the area of public health; for archiving purposes in the public
22 CJEU Judgment of 13 May 2014, case C-131/12, Google Spain SL and Google Inc. v. Agencia
Española de Protección de Datos (AEPD) and Mario Costeja González, ECLI:EU:C:2014:317. See
Article 29 Working Party on Data Protection, “Guidelines on the Implementation of the CJEU
Judgment on “Google Spain and Inc v. Agencia Española de Protección de Datos (AEPD) and
Mario Costeja González” C-131/12”, 26 November 2014.
464
P. A. de Miguel Asensio