Safeguarding children and young people’s privacy in New Zealand

28/05/2024·3 mins to read

Safeguarding children and young people’s privacy in New Zealand

The Office of the Privacy Commissioner (OPC) initiated the Children and Young People's Privacy Project (Project) to assess the effectiveness of current laws in safeguarding children's personal information.

In this article we discuss the Project’s key findings and the three themes that emerged.

Key Takeaways

The findings of the Project's consultation phase were released by the OPC earlier in April 2024, and identified the need for:

clearer guidance on children’s privacy issues for parents, children, and professionals.
regulatory reforms to strengthen children's privacy protections.
risk mitigations for children's use of social media.

These findings will no doubt be of interest to organisations who work with children or who collect personal information from children. The report is a clear indication that reforms are likely to be on the way.

Background

Under the Privacy Act 2020 (Privacy Act), children have the same rights as adults regarding their personal information. The Privacy Act requires agencies to be especially careful and fair when collecting information from children or young persons. However, concerns have been raised that the legislation does not go far enough to protect children’s privacy in today’s digital age. Children are thought to be particularly vulnerable to privacy harms, and special care is needed to ensure that their privacy is protected, especially in online environments.

The OPC is therefore examining the protection of children and young people's privacy rights through the Children and Young People's Privacy Project in September 2023. The Project aims to evaluate the effectiveness of existing laws in safeguarding the personal information of our youth, to ensure that the personal information of all young individuals is appropriately protected and treated with respect.

In late 2023 the OPC consulted with various stakeholders, seeking their views on children’s privacy rights in New Zealand. The OPC released a report on Safeguarding children and young people’s privacy in New Zealand (Report) in April 2024 summarising the responses received through the consultation process. Three key themes have emerged, which we outline in more detail below.

Theme One: The need for clear guidelines
The consultation identified the need for: Guidance for parents to help understand and protect their children’s privacy rights, including in the context of technology like social media. Guidance for children to empower them to understand and protect their privacy through guidance that is easy to understand and tailored to different age groups. Guidance for professionals, with the need for sector-specific guidelines (particularly in the education and health sectors), and training to navigate the complexities of children's privacy rights effectively.

Theme One: The need for clear guidelines

The consultation identified the need for:

Guidance for parents to help understand and protect their children’s privacy rights, including in the context of technology like social media.

Guidance for children to empower them to understand and protect their privacy through guidance that is easy to understand and tailored to different age groups.

Guidance for professionals, with the need for sector-specific guidelines (particularly in the education and health sectors), and training to navigate the complexities of children's privacy rights effectively.

Theme Two: The need for regulatory changes
The consultation results highlighted a need for regulatory reforms to bolster the protection of children’s privacy, including: directions for organisations on how to factor in the age or capacity of the child (particularly as it relates to consent); a requirement to consider the best interest of the child in privacy matters; the creation of the right to be forgotten (the right to have personal information removed or deleted); a requirement for organisations to be more transparent, including the use of direct, plain, and child-friendly language in privacy statements; stricter penalties for organisations breaching children's privacy rights; restrictions on how children’s personal information can be used; minimum age requirements for using social media; and improving redress for breaches. The OPC noted that there are several options available for achieving regulatory reform, including through amendments to the Privacy Act or by the Privacy Commissioner issuing a code of practice to address particular issues.

Theme Two: The need for regulatory changes

The consultation results highlighted a need for regulatory reforms to bolster the protection of children’s privacy, including:

directions for organisations on how to factor in the age or capacity of the child (particularly as it relates to consent);
a requirement to consider the best interest of the child in privacy matters;
the creation of the right to be forgotten (the right to have personal information removed or deleted);
a requirement for organisations to be more transparent, including the use of direct, plain, and child-friendly language in privacy statements;
stricter penalties for organisations breaching children's privacy rights;
restrictions on how children’s personal information can be used;
minimum age requirements for using social media; and
improving redress for breaches.

The OPC noted that there are several options available for achieving regulatory reform, including through amendments to the Privacy Act or by the Privacy Commissioner issuing a code of practice to address particular issues.

Theme Three: The need to address the risks of social media
Significant concerns were raised regarding children’s use of social media and the associated privacy risks, including: the rise of “sharenting”, where parents use images or personal details of their children on social media, sometimes for monetary gain; children's use of social media and their vulnerability to privacy breaches, cyberbullying, and the permanence of online content; the difficulty in verifying and enforcing minimum age requirements on social media; and risks of children’s personal information being shared with or used by third parties. The OPC stated that they will consider these concerns in any future action they take, including drafting guidance and looking into an option for a regulatory response. The results of the Project’s consultation were echoed in the results of the OPC’s recent biennial privacy survey of New Zealanders which were published in May 2024. The survey results reinforced the call for further measures to strengthen children’s privacy rights, particularly when it comes to children’s activities online.

Theme Three: The need to address the risks of social media

Significant concerns were raised regarding children’s use of social media and the associated privacy risks, including:

the rise of “sharenting”, where parents use images or personal details of their children on social media, sometimes for monetary gain;
children's use of social media and their vulnerability to privacy breaches, cyberbullying, and the permanence of online content;
the difficulty in verifying and enforcing minimum age requirements on social media; and
risks of children’s personal information being shared with or used by third parties.

The OPC stated that they will consider these concerns in any future action they take, including drafting guidance and looking into an option for a regulatory response.

The results of the Project’s consultation were echoed in the results of the OPC’s recent biennial privacy survey of New Zealanders which were published in May 2024. The survey results reinforced the call for further measures to strengthen children’s privacy rights, particularly when it comes to children’s activities online.

What’s Next?

The Report highlights the OPC’s commitment to putting the well-being of children at the forefront in the context of the modern digital landscape, and to bring New Zealand in line with international developments in children’s privacy.

The OPC is considering the feedback from the consultation and will announce its next steps in late 2024. The report is our clearest indication yet that we are likely to see some strengthening of privacy safeguards for children.