Opt-in to all processing or use of a child's data by commercial third-parties
Children's data is a hugely valuable commodity to advertisers. What they like, how they react, what they respond to are all aspects of behavioural modelling and prediction systems that enable advertisers to design and plant messages that will spread.
However, there is growing evidence that education authorities are on occasion appropriating parental control over children's personal data - a commodity which the child legally owns under GDPR - and are providing this to commercial third parties without either the informed consent or in some cases knowledge of parents.
The UK GDPR legislation is clear that data use must be "processed lawfully, fairly and in a transparent manner in relation to the data subject", collected "for specified, explicit and legitimate purposes and not further processed" and must be "limited to what is necessary in relation to the purposes for which they are processed".
Furthermore, the Information Commissioner's guidance is clear that public authorities may not claim a reason such as the delivery of a public service as the legal basis for collecting a child's data if they can "reasonably achieve the purpose by some other less intrusive means, or by processing less data."
This means if it is possible to deliver education, without supplying a child's data to a particular commercial third party, then the lawful basis of 'public task' likely does not apply, and consent may need to be sought from the parent and/or child.
There is a substantial lack of transparency over what is being done with a child's digital behavioural data, when collected via school devices, including who the data is being processed by and for what purpose.
Right
Parents have a right to be informed and in most cases provide explicit consent before their child's data is supplied to commercial third parties for activities such as storage, processing or modelling.