The ICO issued the code on 12 August 2020 and it will come into force on 2 September 2020 with a 12 month transition period.
Information Commissioner Elizabeth Denham writes:
Data sits at the heart of the digital services
children use every day. From the moment a young person opens an app, plays a game or loads a website, data begins to be gathered. Who's using the service? How are they using it? How frequently? Where from? On what device?
information may then inform techniques used to persuade young people to spend more time using services, to shape the content they are encouraged to engage with, and to tailor the advertisements they see.
For all the benefits the
digital economy can offer children, we are not currently creating a safe space for them to learn, explore and play.
This statutory code of practice looks to change that, not by seeking to protect children from the digital world,
but by protecting them within it.
This code is necessary.
This code will lead to changes that will help empower both adults and children.
One in five UK internet users are
children, but they are using an internet that was not designed for them. In our own research conducted to inform the direction of the code, we heard children describing data practices as nosy, rude and a bit freaky.
national survey into people's biggest data protection concerns ranked children's privacy second only to cyber security. This mirrors similar sentiments in research by Ofcom and the London School of Economics.
This code will lead
to changes in practices that other countries are considering too.
It is rooted in the United Nations Convention on the Rights of the Child (UNCRC) that recognises the special safeguards children need in all aspects of their life.
Data protection law at the European level reflects this and provides its own additional safeguards for children.
The code is the first of its kind, but it reflects the global direction of travel with similar reform being
considered in the USA, Europe and globally by the Organisation for Economic Co-operation and Development (OECD).
This code will lead to changes that UK Parliament wants.
Parliament and government ensured UK
data protection laws will truly transform the way we look after children online by requiring my office to introduce this statutory code of practice.
The code delivers on that mandate and requires information society services to
put the best interests of the child first when they are designing and developing apps, games, connected toys and websites that are likely to be accessed by them.
This code is achievable.
The code is
not a new law but it sets standards and explains how the General Data Protection Regulation applies in the context of children using digital services. It follows a thorough consultation process that included speaking with parents, children, schools,
children's campaign groups, developers, tech and gaming companies and online service providers.
Such conversations helped shape our code into effective, proportionate and achievable provisions.
Organisations should conform to the code and demonstrate that their services use children's data fairly and in compliance with data protection law.
The code is a set of 15 flexible standards 203 they do not ban or specifically prescribe 203 that provides built-in protection to allow children to explore, learn and play online by ensuring that the best interests of the child
are the primary consideration when designing and developing online services.
Settings must be high privacy by default (unless there's a compelling reason not to); only the minimum amount of personal data should be collected and
retained; children's data should not usually be shared; geolocation services should be switched off by default. Nudge techniques should not be used to encourage children to provide unnecessary personal data, weaken or turn off their privacy settings. The
code also addresses issues of parental control and profiling.
This code will make a difference.
Developers and those in the digital sector must act. We have allowed the maximum transition period of
12 months and will continue working with the industry.
We want coders, UX designers and system engineers to engage with these standards in their day-to-day to work and we're setting up a package of support to help.
But the next step must be a period of action and preparation. I believe companies will want to conform with the standards because they will want to demonstrate their commitment to always acting in the best interests of the child.
Those companies that do not make the required changes risk regulatory action.
What's more, they risk being left behind by those organisations that are keen to conform.
A generation from now, I believe we
will look back and find it peculiar that online services weren't always designed with children in mind.
When my grandchildren are grown and have children of their own, the need to keep children safer online will be as second
nature as the need to ensure they eat healthily, get a good education or buckle up in the back of a car.
And while our code will never replace parental control and guidance, it will help people have greater confidence that their
children can safely learn, explore and play online.
There is no doubt that change is needed. The code is an important and significant part of that change.
A public consultation has closed on changes to Scotland's hate crime laws that will diminish free speech even further.
The plans to make it a criminal offence to stir up hatred, criticise or insult anyone based on their age, disability, religion,
sexual orientation or transgender identity.
The bill will massively step up the definitions of what people are not allowed to stay lest it be considered insulting to easily offended identity groups, particularly sensitive religions. The bill also
extends from people's words into the possession of material that might be considered critical of sensitive identity groups.
The disgraceful bill has been opposed by many particularly the most effected, like newspapers.
Opposition to the
bill has united the Catholic Church and the National Secular Society in opposition to the plans - along with academics, playwrights and newspaper columnists who all say they fear the proposed legislation will pose a threat to their freedom of speech. For
example comedians could become too frightened to dare make a joke about a Scotsman, an Englishman and an Irishman walking into a bar.
The public were invited to make their views known to the Scottish parliament's justice committee before midnight
on 24 July.
Amanda Millar, president of the Law Society of Scotland, said:
It was right that laws provide a clear message that hatred should have no place in our society. However, we have significant
reservations regarding a number of the bill's provisions and the lack of clarity, which could in effect lead to restrictions in freedom of expression, one of the foundations of a democratic society. We have real concerns that certain behaviour, views
expressed or even an actor's performance, which might well be deemed insulting or offensive, could result in a criminal conviction under the terms of the bill as currently drafted.
Scottish Labour criticised the offence of stirring up
hatred and accused ministers of failing to learn the lessons of the repealed Offensive Behaviour at Football Act. The party's justice spokesman James Kelly said:
There is a significant divergence from similar law in
England and Wales where intent is required for a person to be criminalised for behaviour which another finds insulting. Under the current proposals, the law here would not require this intent to be present - which sets an alarming legal precedent and
could result in the criminalisation of expressions of religious views.
In its submission to Holyrood's Justice Committee, the Scottish Newspaper Society warned that it contained highly dangerous measures which pose a serious threat to
freedom of expression in its broadest sense. The organisation's director, John McLellan, said it had the potential to provoke a string of vexatious complaints against journalists and columnists, which could then lead to police investigations. He raised
further concerns about provisions against communicating insulting material:
It would also be an offence to distribute it, which potentially could see newspaper delivery boys and girls, or shops, fall foul of the law.
Allowing courts to direct the destruction of material had echoes of darker times and could lead to the banning of books or censorship of the internet, he warned.
He added that JK Rowling, who has recently faced a
deluge of criticism from transgender rights activists after she expressed her views online, would almost certainly have seen her subjected to a police investigation had the proposed law been in force.
A coalition of age verification companies have won the first round of their legal action against the Government in a bid to force ministers to introduce a shelved internet porn censorship scheme that would provide the companies with an income.The
companies launched an appeal last year, saying they developed software that was never used.
A judge ruled that age verification companies, backed by children's charities, have an arguable case that the Culture Secretary exceeded her powers by deciding
not to implement the ban, which had been voted for by Parliament .
The ruling means the claimants can now take the case to a judicial review, which could overturn the Government's decision.
Plans to introduce an age verification scheme were
shelved in October last year, perhaps because the law did not provide any provision for keep very dangerous ID and porn browsing data private and safe. At the time, ministers said the age verification scheme as defined in the Digital Economy Act 2017
would be superceded by forthcoming Duty of Care legislation.
In court, the Government argued that ministers had not exceeded their powers and that circumstances had radically altered since the porn ban legislation was originally passed.