4 / 8
Collection and Use of Personal Data through the Internet – Points to Note for Data Users Targeting at Children / December 2015
Use of personal data
Default setting
Children may not be aware that they could check or change all the privacy settings before using online platforms.
Data users should therefore ensure that default configurations are pre-set with privacy protection in mind, and
inform children accordingly.
Best Practice Tip
• In the case of online platforms that involve the sharing of information between users or members of the
public, the default setting for all sharing should be as restrictive as possible. There should be sufficient
notice and explanation to the children on the implications of setting and making changes to these
settings.
Disclosure of personal data
On online platforms where children’s personal data is to be published, data users should be mindful of providing
clear notice to children on or before collecting the data, as well as limiting the audience of such information to
those who have a genuine need to access that information. Data users should also consider using pseudonyms
to identify individuals. As a best practice, data users should provide means to enable children to opt-out of such
publication.
Tips
• When posting participant lists for sporting events, data users should use pseudonyms (such as participant
number), limit any other information to be disclosed (such as identity card number, date of birth, etc.)
and/or limit the accessible audience to the smallest group possible; and
• When posting event photos, data users should do this in a respectful manner and ensure that all
participants are informed of the arrangement before pictures are taken and, as a best practice, offer an
opt-out mechanism.
Change of use
If data users wish to change the use (including disclosure) of children’s personal data, they must obtain prior consent
from the children.
2
Tips
• If schools or educational institutions have not made it clear to children that they would post their
examination results online, they should obtain consent before doing so. Alternatively, schools or
educational institutions may consider publishing the overall examination results without identifying a
particular individual.
4
Parents may give consent on behalf of children as appropriate or necessary, and where the parents have reasonable grounds
to believe that the use of the personal data for the new purpose is clearly in the interest of the children.
2