Managing Deletion Requests for Children's Data

Overview

Deletion of children's personal data operates under heightened obligations compared to adult data deletion. Under GDPR Article 17, the right to erasure applies with particular force when data was collected from a child — Article 17(1)(f) explicitly creates a right to erasure where personal data has been collected in relation to the offer of information society services to a child under Article 8(1). COPPA Section 312.6 requires operators to provide parents with the ability to review and delete personal information collected from their child. The UK AADC Standard 15 requires prominent and accessible tools to help children exercise their data protection rights. This skill provides a comprehensive framework for processing deletion requests involving children's data, including the complex questions of who can request deletion, verification procedures, scope determination, and third-party notification.

Legal Framework

GDPR Article 17(1)(f) — Right to Erasure for Children's Data

"The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where [...] the personal data have been collected in relation to the offer of information society services directly to a child referred to in Article 8(1)."

This ground for erasure is distinct from the other Art. 17(1) grounds because:

• It does not require that the original lawful basis has been withdrawn (unlike Art. 17(1)(b) consent withdrawal)
• It does not require that the data is no longer necessary (unlike Art. 17(1)(a))
• It applies specifically because the data was collected from a child, regardless of whether the data subject is still a child at the time of the request
• The CJEU has confirmed in Case C-131/12 (Google Spain) that the right to erasure is especially important where the data was collected when the data subject was a minor

GDPR Article 17(2) — Third-Party Notification