Jenny Afia, Partner, Schillings - written evidence (CHI0024)

My background

1. As a privacy lawyer at Schillings – an international privacy and reputation consultancy – I help people in the public eye and their families reduce intrusions into their personal lives.

2. Schillings has been responsible for some of the leading privacy cases, including:

1. Campbell v MGN Ltd[1], which established an individual’s right to privacy under English Law.
2. Murray v Big Pictures UK Ltd (for JK Rowling’s child)[2] which established the law should protect children from intrusive media attention.
3. Rocknroll v News Group Newspapers Limited[3] which considered how images from social media sites can be used by third party publishers.

3. I won Legal Week’s Young Lawyer of the Year Award in 2008, am ranked as a leader in my field by Chambers & Partners and last year became Spears’ Magazine’s Reputation and Privacy Lawyer of the Year. 

4. I am on the Leadership Council of 5 Rights[4], a civil society initiative which seeks to enable all children to access the digital world creatively, knowledgeably and fearlessly. I am also a member of the Children Commissioner's Task Force on Children and the Internet[5], formed to ensure children’s interests are at the heart of the development of the internet and web-based technology.

About this submission:

5. In this submission, I respond to the following questions in the ‘Call for Evidence’ regarding Legislation and Regulation:

a)      Q10. What challenges face the development and application of effective legislation? In particular in relation to the use of national laws in an international/cross-national context and the constantly changing nature and availability of internet sites and digital technologies? To what extent can legislation anticipate and manage future risks?

b)      Q12. What more could be done by the Government? Could there be a more joined-up approach involving the collaboration of the Government with research, civil society and commerce?

Summary

6. In my view, existing English and Welsh laws are broadly and theoretically sufficient to provide protection for children’s rights online. The key issue is that the laws are routinely ignored.  I believe this stems from a lack of awareness as to what rights exist and some practical difficulties in applying those rights to children.

7. To address this challenge, a joined-up approach involving Government, civil society and commerce should be based around the principle that a child is a child until they become an adult, not until they go online. 

8. Once this obvious but ignored principle is adopted, existing laws and commercial practices will be viewed differently, through the perspective of children.  Practical changes are likely to flow.  Two examples of such changes, regarding Subject Access Requests and Terms and Conditions, are suggested below.

Existing Laws

9. In July 2015 Schillings reviewed whether the “5 Rights” - namely the right to remove, the right to know, the right to safety and support, the right to make informed and conscious choices and the right to digital literacy – are reflected in English law.  We regard the 5Rights as a useful tool to understand the existing rights of children and how they manifest online. They should be viewed against the backdrop of other international and national frameworks of children’s rights; perhaps the most significant of which is the United Nations Convention on the Rights of the Child. 

10. It was evident from our review that there is a great deal of legislation to protect and empower children online.

11. The following legislation was considered:

a)      The Communications Act 2003.

b)      The Copyright Designs and Patents Act 1988.

c)      The Data Protection Act 1998.

d)      The General Data Protection Regulation [in draft].

e)      The Defamation Act 2013.

f)       The Defamation (Operator of Websites) Regulations 2013.

g)      European Convention on Human Rights.

h)      Human Rights Act 1998.

i)        The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013.

j)        The Consumer Contracts Act 2013.

k)      The Consumer Rights Act 2015.

l)        The Consumer Protection from Unfair Trading Regulations 2008.

m)   The Computer Misuse Act 1990.

n)      The Data Protection Act 1998.

o)      The Electronic Commerce (EC Directive) Regulations 2002.

p)      The Coroners and Justice Act 2009.

q)      The Criminal Justice and Courts Act 2015.

r)       The Criminal Justice and Public Order Act 1994.

s)       The Education and Inspections Act 2006.

t)       The Malicious Communications Act 1988.

u)      The Protection from Harassment Act 1998.

v)      The Video Recordings Act 2010.

w)    The Education Act 2011.

x)      The Minors’ Contracts Act 1987.

y)      Sale of Goods Act 1979.

z)       The Unfair Terms in Consumer Contracts Regulations 1999.

12. Key findings from Schillings’ review were that:

a)      Children can ask search engines to remove links to information about themselves which is irrelevant, out-dated or otherwise inappropriate.[6]

b)      Children have the right to privacy which includes privacy online.[7]

c)      Children have the right to a reputation which includes the right not to be unlawfully defamed online.[8]

d)      Children have the right to stop websites from publishing photos or images they have created in which they own the copyright.[9]

e)      Parental consent would normally be required when collecting personal data from children under 12.[10]

f)       Children have the right to find out what information any ‘data controller’ is holding about them, why it is being processed and who it is being shared with.[11]

g)      Children have a right to know how and when their information will be used by an organisation operating online.[12]

h)      Children have the right to have their personal information stored online protected.[13]

i)        It is illegal to harass a child online or via an electronic device.[14]

j)        It is illegal to send grossly offensive messages to children or about them to third parties.[15]

k)      It is an offence to use the internet or any electronic device to encourage or assist a child to commit suicide.[16]

l)        The internet cannot be used to sexually exploit children.[17]

m)   Children have the right to be protected against cyberbullying by their school.[18]

n)      Children must be protected from exposure to depictions of violence, self-harm, criminal offences and sexual activity in online videos and games.[19]

o)      Care must be taken when communicating marketing to children and young people.[20]

p)      Particular care must be taken when broadcasting gambling advertisements or producing non-broadcast marketing communications about gambling to ensure that children or young persons are not harmed or exploited.[21]

q)      Children can ask website operators not to subject them to automated decision-taking.[22]

r)       On the whole, children cannot form contractually binding relationships before they turn 18 years old.[23]

s)       Contract law protects children who cannot fully understand the significance and implications of a contract.[24]

t)       Adult permission must be obtained before minors under 16 can buy complex or costly products.[25]

u)      A person cannot mislead children about a product they are selling, or hide information from them.[26]

v)      The online and app-based games industry must not exploit children’s inexperience, vulnerability, credulity including by aggressive commercial practice.[27]

w)    OFCOM has a duty to promote learning by children about using the internet.[28]

x)      Schools are required to teach children about the internet.[29]

y)      Children have the right not to be exposed to content on video on demand platforms which might seriously impair their development.

Application of the laws

13. The biggest problem arises not in the lack of laws but in how they are applied. 

14. Based on my extensive experience in working with adults whose rights have been infringed online, I suspect children are often unaware of their rights. Greater awareness and education of the rights already in existence is critical. 

15. Further, existing legislation should be assessed from the fundamental perspective that a child is a child until they become an adult, not until they go online. 

16. Applying this principle to our current laws highlights various practical difficulties which impact the application of the laws.  To provide two examples:

1. First, under section 9(1) Consumer Contracts Regulations 2013 (SI 1999/2083) children have a right to expect consumer information to be communicated clearly and comprehensibly.  Yet the way in which Terms and Conditions are routinely presented for websites and apps is far from clear for children (indeed, even for adults).  Consequently children are not able to provide informed consent before transacting with such companies.

2. Second, under the Data Protection Act 1998, children, like adults, are entitled to make “Subject Access Requests” to find out what information a ‘data controller’ such as an online company holds about them.  In theory, by submitting a written request a child can find out what, if any, personal data (such as photos of them, information about their hobbies) the organisation is processing, why it is processing the data, which organisations or people the data has been or may be given to and any available information as to the source of the data and to also be given a copy of the information containing the data.  In most cases, the organisation needs to respond to the subject access request within 40 days. 

Yet the Subject Access Request must be accompanied with a £10 fee to reflect the organisation’s costs of complying with it. This fee is likely to prove prohibitive for many children.

I submit that the £10 fee should be waived when children make Subject Access Requests.  This will transfer more cost to companies but in my view that is an acceptable expense in exchange for transacting with and collecting data about children. There is already precedent in the field of privacy law for according children’s rights the highest priority in instances where there are competing rights.[30]

17. We are happy to provide further examples of practical difficulties in applying the existing legislation to children if the Inquiry would find them useful.  As a firm, we have been troubled at how whole tranches of the law designed to protect children are routinely ignored by organisations and businesses that in other contexts pride themselves on compliance.  The Inquiry may wish to ask representative businesses what practices they adopt to reflect the different status of children to adults when providing online services to them.

18. Finally we welcome this Inquiry and in particular any changes to make legal rights practical as opposed to just theoretical.

-          Ends -

26 August 2016