Collection and Use of Personal Data through the Internet – Points to Note for Data Users Targeting at Children

Collection and Use of Personal Data through the Internet – Points to Note for Data Users Targeting at Children / December 2015

Interaction with social networks

When data users require or allow children to use their social network accounts for interaction (such as logging in,

using “like”, “share” or similar action that may show the children’s social network account names) with their online

platforms, the children may not be aware that this interaction can be seen by other users of the social network or the

online platform. In many cases, the data users or others may be able to collate/combine information from the social

network and the online platforms to profile or identify the children. Data users should explain clearly to children

the implications of using social network accounts.

Best Practice Tip

• Data users should offer either anonymous log-in or allow children to create separate accounts (instead

of requiring or allowing the use of social network accounts) on their online platforms.

Redirection to other sites

As a best practice, when an online platform redirects children to another site, clear notice should be given to the

children. This is particularly important when the redirected site is not under the direct control of the same data user.

In the absence of such notice, children run the risk of unintentionally or unknowingly disclosing their own personal

data.

Best Practice Tip

• When redirecting children from one online platform to another, data users should display a message

telling the children details of the site they are being redirected to, and its relationship with the data users

(such as a subsidiary or related company, an organiser of events, etc.).

Direct marketing activities

The Ordinance prescribes circumstances where direct marketing using personal data are permissible. Data users

should be mindful that, even for non-profit making purposes, the promotion or advertising of services (including

solicitation of donation) is considered as direct marketing activities. They should familiarise themselves with the

requirements before conducting any direct marketing activities. Data users should, therefore, refer to the ‘New

Guidance on Direct Marketing’

issued by the Privacy Commissioner for Personal Data for details.

For example, data users who intend to use a child’s personal data in direct marketing, must inform the child

accordingly, obtain his prior consent

and provide him with a channel through which his consent may be

communicated.

Data users should note that even adults sometimes have problems navigating the various clauses and consent forms

of direct marketing, therefore expecting children to understand their rights in direct marketing may be unrealistic.

See

In the context of direct marketing, the meaning of the word “consent” includes an indication of no objection.