My Lords, I echo the comments of the noble Lord, Lord McNally, to say we are grateful to the noble Baroness, Lady Howe. I acknowledge, particularly after her Second Reading speech, that she has not immediately demanded that the age be put back up to 16, which I thought she might. She has produced an interesting amendment.
Amendment 16 would give the Information Commissioner the power to determine the age threshold at which children can consent to their data being processed by online information services. This would be based on consultation and evidence. While it is certainly a preferable proposal to a blanket increase to 16, I am afraid I still cannot agree.
First, the Information Commissioner’s role as an independent regulatory authority is to administer and enforce the application of data protection legislation. As part of that role the Commissioner provides advice
to businesses, organisations and individuals on the proper implementation of the legislation and on their rights under that legislation, and provides redress for breaches of individuals’ personal data. It also has an advisory function in relation to Parliament, the Government and other institutions. By contrast, the question of affixing the age below which parental consent is required has much broader-ranging considerations and implications, including an important moral dimension. Requiring the Information Commissioner to be the one to answer it would place on the officeholder an extra demand for which the office is neither designed nor resourced.
Secondly, the GDPR specifies that it is member states that should make this important decision. It does not give the power for states to delegate this choice to another regulatory body. Therefore, this amendment would make the Bill as a whole non-compliant with the GDPR. It is for those reasons that the Government consider that the question should be decided by this House and the other place rather than by a regulatory body. I realise that, in saying that, we leave ourselves open to further discussions on this matter.
10 pm
Amendment 17 tests the meaning of the exception to the requirement of parental consent for children to share their personal data to access counselling services. Children, whatever their age, should be able to obtain support from professional services such as ChildLine and that is the purpose of the exemption. The noble Lord, Lord Stevenson, asked me several questions, including on the definition of “preventive” and “counselling”. We suggest that “preventive” could refer to the prevention of any form of serious harm to which a child might be exposed—for example, physical or sexual abuse, trafficking or forced marriage; “counselling” would likely encompass at least the giving of advice to children on a range of personal, social or psychological matters. The Government recognise that there is a public interest in ensuring that the definition is not drawn too broadly to prevent children’s exposure to commercial or criminal entities masquerading as these services.
We have already debated the legal applicability of the recitals of the GDPR. The Government consider excluding preventive and counselling services from the scope of article 8 to be consistent with the purposes of the GDPR in light of the 38th recital, which states:
“The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child”.
I accept that recitals do not have the same normative effect—I think that that is the expression—but they are useful. Courts take them into account when looking at how the articles should be interpreted. The GDPR contains 31 pages of them—173 recitals. The European Parliament has spent a lot of time considering them, so we should be able to bear them in mind to help us illustrate what the Parliament was thinking when it passed the articles themselves, in the same way that the courts in this country can look at Explanatory Memoranda and what a Minister says from the Dispatch Box.
This exception is also appropriate in light of the UK’s status as a signatory to the UN Convention on the Rights of the Child, in particular Articles 13, 16 and 19. For those reasons, we consider it important to make this exception clear in the Bill.
I turn to Amendment 188, tabled by my noble friend Lord Arbuthnot. The request here is that the age at which children may exercise their rights under this Bill and consent to data sharing in Scotland is altered from 12 to 13. The Government understand that the intention behind this is to bring parity between the online and offline regulation in Scotland. In England and Wales when considering whether a child has the capacity to consent the common law “Gillick test” is applied. It is generally taken that a child of 12 years old and above will have the maturity and understanding to give consent. Additionally, the GDPR states that, notwithstanding that a child of 12 or younger may have the maturity and understanding to give consent in their own right, they may not do so in relation to data sharing with online services until they are 13 years old.
In Scotland, capacity is governed by statute. Unless a child falls into one of the exceptions under which they may consent for themselves, a child does not have capacity to consent until they are 16 years old. This clause creates an exception to this so that children in Scotland are presumed to have the maturity and understanding to exercise rights and give consent under this Bill at age 12 and above. This means that children in Scotland are in the same position as children in England and Wales: they can consent where they have the maturity and understanding to do so, usually at 12, but in relation to online services only, they cannot do so until they turn 13.
If we were to accept the amendment, sufficiently mature 12 year-olds in England and Wales could consent to their data being processed—except in relation to the provision of online services—and exercise rights such as the right to be forgotten, but children in Scotland could not. Therefore, while the amendment would create consistency between the online and offline approaches in Scotland, it would risk creating disparity between the rights of Scottish children and those in the rest of the UK.
The Government recognise the need for consistency in regulation but we believe that the priority should be to provide consistency for all UK children. For this reason, it is essential that the age in Scotland be set at 12 to, in effect, match that in England and Wales. This prevents Scottish children being at a disadvantage compared to their English and Welsh counterparts—it is as simple as that. I therefore ask the noble Baroness to withdraw her amendment.