Report of the Special Rapporteur on the right to privacy (HRC 25-01-2021)
Artificial intelligence and privacy, and children’s privacy Report of the Special Rapporteur on the right to privacy, Joseph A. Cannataci (HRC – 25 January 2021)
II. Principles and recommendations on the right to privacy of children
Identification of issues
Sexuality, gender, bodily integrity and physical autonomy
- Children vary enormously in their physical, intellectual, social and emotional capacity. The differences are particularly pronounced in adolescence, a period characterized by rapid physical, cognitive and social changes, including sexual and reproductive maturation.58
- The bodily integrity and autonomy rights of children, however, are infringed by the actions of Governments, commercial entitiesSexual expression, bodily integrity and physical autonomy are part of the interwoven fabric of children’s privacy, and also of their freedom of expression.59 Adolescents need to be able to make decisions regarding their well-being and bodies, and to safely and privately explore their sexuality as they mature,60 whether offline or online.61
- The bodily integrity and autonomy rights of children, however, are infringed by the actions of Governments, commercial entities, health-care and other professionals, parents and peers. Infringements identified include:62
- Girls being subjected to female genital mutilation; forced marriages; forced sex; forced pregnancy and motherhood; forced pregnancy testing; forced sterilizations; denial of reproductive sexual information and services; mandatory parental notification and/or consent for prescribed contraceptives and abortion; “conversion” therapies; criminal penalties for consensual peer sexual activity, including sexting; sexual abuse online and offline; “honour” killings; and “slut shaming”;
- Boys being subjected to genital mutilation; forced marriages; forced sex; forced sterilizations; denial of reproductive sexual information and services; “conversion” therapies; criminal penalties for consensual peer sexual activity, including sexting; sexual abuse online and offline; harassment; and corporal punishment;
- Children with diverse gender identities, sexual orientations and expression, and variations in sex characteristics being subjected to violence; discrimination and harassment; pathologization of their gender identity or body; unnecessary medical treatment; publication of details concerning genitalia; stigmatization; “instructive” rape; “conversion” therapies; withholding of specific health services, including trans health-care and reproductive sexual information and services; denial of access to medical records; criminal penalties for consensual peer sexual activity, including sexting; sexual abuse online and offline; and lack of legal gender recognition.
- Infringements of bodily privacy impact other rights, such as those enshrined in articles 3, 6, 8, 12, 16, 19 and 29 (1) of the Convention on the Rights of the Child. For example: 63
- Surveys to identify sex/gender diverse students violate the right to nondiscrimination, and when used to expel students, breach their right to education;
- Highly medicalized processes entailing surgery for legal gender recognition implicate the right to health;64
- Mandatory parental consent or notification for sexual or reproductive health services implicate the right to health, identity, life, protection from harm and the best interests of the child.
- Children need and have the right to guidance on healthy sexual relationships, consent and safe practices. 65 Comprehensive sexuality education can help children protect and advance their privacy, independence and autonomy,66 and facilitate well-being, particularly for LGBTQI young people. 67 Backlashes against providing children and adolescents with comprehensive sexuality education were reported around the world, including in Brazil, the Dominican Republic, Ghana, Kenya and Poland.68
Recognition of identity
- All individuals have rights precisely because of their inherent and equal identity as human beings.69 Records and record-keeping systems establish official identity, 70 yet rarely afford children agency over their records.
- Official identity commences with birth registration. Yet many children around the world, and disproportionately among Aboriginal and indigenous communities, are not registered. 71 The lack of legal recognition affects access to many rights necessary for autonomy, such as education.
- Birth certificates can pose challenges to attaining dignity, identity, privacy and development for transgender and intersex children, children born through international surrogacy arrangements, missing children, unaccompanied refugee children and children in out-of-home care, among others. 72
- Promoting children’s privacy and nurturing their autonomy requires:
- (a) Establishing policies, laws and regulations that:
- Cast children as the bearers of human rights where their rights to privacy, autonomy and equality are inalienable;114
- Incorporate the broad scope of privacy, not solely data protection, to enable the full development of children’s potential;115
- Incorporate children’s views, children’s strategies for privacy, findings of child-focused research and/or child privacy impact assessments in public policy settings;116
- Provide independent means to conciliate, arbitrate and remedy individual or systemic human rights violations against children 117 and ensure that enforcement measures are taken in case of infringements;118
- Addressing the structural dynamics that position children as vulnerable and without agency;
- Encouraging technological innovations to improve information communication services while protecting children’s privacy.119
- The Special Rapporteur recommends that States:
- (a) Ensure that the rights and values of the Convention on the Rights of the Child concerning privacy, personality and autonomy underpin government legislation, policies, decisions, record systems and services;
- (b) Support comprehensive analyses of children’s capacity for autonomous decision-making for accessing online and other services, to enable evidence-based child specific privacy laws, policies and regulations;
- (c) Adopt age appropriate standards as a regulatory instrument only with the greatest of caution when no better means exist;
- (d) Promote and require implementation of safety by design, privacy by design and privacy by default guiding principles for products and services for children and ensure that children have effective remedies against privacy infringements;
- (e) Encourage partnerships with civil society and industry to co-create technological offerings in the best interests of children and young people;
- (f) Adopt the Special Rapporteur’s recommendations for protecting against gender-based privacy infringements (A/HRC/43/52, paras. 33–34);
- (g) Develop comprehensive online educational plans of action based on article 29 (1) of the Convention on the Rights of the Child and the Council of Europe guidelines on children’s data protection in an education setting;120
- (h) Ensure appropriate legal frameworks are established and maintained for online education;
- (i) Create public infrastructure for non-commercial educational and social spaces;
- (j) Remedy all legislative gaps and procedural exceptions to ensure all children in contact with justice systems have their privacy maintained throughout all proceedings, with lifelong non-publication orders for any criminal justice record;
- (k) Review legal frameworks to enable voluntary action by companies to lawfully and proportionately detect online child sexual abuse material;
- (l) Ensure that the personal data of children associated with terrorist or violent extremist groups are classified and shared only where strictly necessary to coordinate individual rehabilitation and reintegration;
- (m) Prior to the linking of civil and criminal identity databases, undertake human rights impact assessments on the implications for children and their privacy, and conduct consultations to assess the necessity, proportionality and legality of biometric surveillance;
- (n) Establish practices and laws to ensure that information provided to the media does not violate children’s right to privacy and that reporting by media and other bodies protects the privacy of children whose parents are in conflict with the law;
- (o) Ensure that children’s privacy is upheld in all contacts with incarcerated parents, including written, electronic and telephone communications, and prison visits;
- (p) Ensure that biometric data is not collected from children, unless as an exceptional measure only when lawful, necessary, proportionate and fully in line with the rights of the child;
- (q) Ensure that children’s personal data is processed fairly, accurately, securely, for a specific purpose in accordance with a legitimate legal basis utilizing data protection frameworks representing best practice, such as the General Data Protection Regulation and Convention 108+;
- (r) Ensure that those who process personal data, including parents or carers and educators, are made aware of children’s right to privacy and data protection;
- (s) Ensure that information is available to children on exercising their rights on, for example, the websites of data protection authorities, and ensure the provision of counselling, complaint mechanisms and remedies specifically for children, including for cyberbullying;
- (t) Ensure that anonymity, pseudonymity or the use of encryption technologies by children are not prohibited in law or in practice;
- (u) Ensure that opportunities are available to children and young people of all backgrounds to participate in decision-making and design of frameworks, policies and programmes aimed at them;
- (v) Prohibit automated processing of personal data that profiles children for decision-making concerning the child or to analyse or predict personal preferences, behaviour and attitudes, with exemption only in exceptional circumstances in the best interests of the child or an overriding public interest, with appropriate legal safeguards;
- (w) Ensure that the rights and values of the Convention on the Rights of the Child concerning privacy, personality and autonomy underpin corporate policies, management decisions and services;
- (x) Implement the Guiding Principles on Business and Human Rights: “Protect, Respect and Remedy Framework” and the gender guidance thereon (A/HRC/41/43, annex);121
- (y) Establish remedial and grievance mechanisms, while ensuring that they do not impede access to State-based mechanisms;
- (z) Provide understandable information on reporting matters of concern, including complaints, and remedial and grievance mechanisms;
- (aa) Take reasonable, proportionate, timely and effective measures to ensure their networks and online services are not misused for criminal or other unlawful purposes that are harmful to children;
- (bb) Engage with law enforcement authorities to support the legal identification and prosecution of perpetrators of crimes against children.
58 Committee on the Rights of the Child, general comment No. 4 (2003).
59 Submissions from Matimba; Council of Europe; Australian Human Rights Commission.
60 Submission from Center for International Human Rights.
61 Submission from ParentsTogether.
62 Submissions from Crock and others; Human Rights Watch; ILGA-Europe, Transgender Europe and The International Lesbian, Gay, Bisexual, Transgender, Queer and Intersex Youth and Student Organisation; NNID, Netherlands organisation for sex diversity; CHOICE for Youth and Sexuality; OutRight Action International; Australian Human Rights Commission; Center for International Human Rights; Council of Europe.
63 Submission from Organisation Intersex International Europe.
64 Submissions from Matimba; A. McCarthy.
65 Committee on the Rights of the Child, general comment No. 15 (2013); Committee on Economic, Social and Cultural Rights, general comment No. 22 (2016); submissions from Australian Human Rights Commission; Mahieu; Center for Reproductive Rights, p. 1.
66 Submissions from Action Canada for Sexual Health and Rights; ILGA Europe, Transgender Europe and The International Lesbian, Gay, Bisexual, Transgender, Queer and Intersex Youth and Student Organisation.
67 Submission from McCarthy.
68 Submission from Human Rights Watch, para. 18.
69 Dinah Shelton, “On identity”, The George Washington International Law Review, vol. 39 (1999).
70 Submission from Rights in Records by Design, Monash University and Federation University; D.Z. v. Netherlands (CCPR/C/130/D/2918/2016).
71 Submission from Australian Human Rights Commission.
72 Submissions from Australian Human Rights Commission; Rights in Records by Design, Monash University and Federation University; Kathryn Allan and David Lacey, “Identity management in disaster response environments: a child exploitation mitigation perspective”, Australian Journal of Emergency Management, vol. 33, No. 3 (July 2018).
114 Bailey and Steeves, eGirls, eCitizens.
115 Submissions from South Australia Commissioner for Children and Young People; International Child Rights Center and MINBYUN; Hungarian National Authority for Data Protection and Freedom of Information, p. 58.
116 Submission from South Australia Commissioner for Children and Young People; Bailey and Steeves, eGirls, eCitizens.
117 Submission from Canadian Human Rights Commission.
118 Submission from 5Rights Foundation.
119 Submission from ACT/The App Association
120 See www.coe.int/en/web/data-protection/-/protect-children-s-personal-data-in-education-setting.
121 See also www.ohchr.org/Documents/Issues/Business/Gender_Booklet_Final.pdf .