Sharing children’s personal data

We funded Action on Rights for Children (ARCH) to establish the current legal position in England and Wales in relation to obtaining consent from people aged under 16 to data-sharing between practitioners and agencies. In addition to examining the legal framwork in the UK, the researchers undertool a comparative study of seven EU countries. ARCH published its report in January 2009.

Recommendations

• The age of 12 is often quoted as the age when children can be presumed able to consent to sharing their personal and sensitive data. This reference to age 12 should be removed from all guidance on the grounds that it has no basis in English law.
• All local authorities should be required to train practitioners in the assessment of children’s capacity and competence to consent to information-sharing.
• Parents should be involved in the consent decisions of their competent children unless the child specifically objects, or there are special reasons against it. Local authorities should establish a default position of involving parents in decisions about sharing their children’s sensitive data unless a competent child refuses such involvement.
• When practitioners share a child’s data, sensitive information may also be collected and shared about parents and siblings. The law already requires that parents should be made aware of this, subject to limited exceptions. We recommend that this basic rule is followed in all cases, unless there are overriding reasons not to inform the parent.
• The Information Commissioner should produce a code of practice for local authorities, setting out standards for data protection training and paying special attention to the protection of children’s data.