The ICO team is making good progress on producing a code that will translate GDPR requirements into design standards for online services, says Elizabeth Denham, the Information Commissioner.
In a blog post published on 7th August she reiterates the the code is necessary as though online services play an ever-growing part in children’s lives, the internet was not designed for them. The code aims not to protect children from the digital world, but instead protect them within it.
The ICO consultation on the proposed code opened in April 2019 and has received more than 450 written responses, as well more than 40 meetings with key stakeholders. In her view the exercise has been helpful in understanding the problems young people can face online, such as when using social media services or popular games, while feedback from developers, tech companies and online service providers have provided insights into the challenges faced by them in making the code a reality.
She also notes that only a few respondents argued against the need to have a code and that data sits at the heart of how this can be achieved. The GDPR already sets out rules on how data can be used and the importance of protecting children so the proposed code aims to make the requirements clearer and help designers and developers understand what is expected of them. She accepts that the standards set out in the code will bring challenges for the industry and there may need to be shifts in the design processes for online services which make greatest use of children’s data.
However, the ICO does not want to see an age-gated internet, where visiting any digital service requires people to prove how old they are: the aim is not to bar children from online services but to protect them within it. It wants providers to set their privacy settings to ‘high’ as a default, and to have strategies in place for how children’s data is handled. Similarly young people should not be prevented from engaging with the world around them so it has responded to concerns that the proposed code would affect news websites.
That final version of the code will be delivered to the Secretary of State ahead of the statutory deadline of 23 November 2019.
The law allows for a transition period of up to a year and the ICO is considering the most appropriate approach to this, before making a final decision in the autumn. In addition to the code itself, the ICO is also preparing a package to ensure that organisations are supported through any transition period, including help and advice for designers and engineers.
