In the next of a new series of articles based on the latest meeting of the Intelliflo GDPR Working Group on GDPR's ramifications for financial advice firms, Rob Walton considers the processing of data on children
A key part of the financial advice process is advising families on their finances and, obviously enough, this often includes dependants of the person or persons to whom the advice is being offered.
The General Data Protection Regulation (GDPR) makes special mention of children and, for the purposes of the regulation, consent cannot be granted without parental approval by anyone under the age of 13. Upon their 13th birthday, data subjects can freely consent to how their data is processed - in other words, they can sign up to newsletters and appropriate alerts.
Unlikely as it may be that a 13-year-old will be signing up for newsletters from financial advisers, advice firms will still be processing large amounts of data on under-13s. Taking Intelligent Office as an example, there are currently more than 75,000 records of people under the age of 13 and so it is important that appropriate checks are in place and that parental consent has been granted at the beginning of the process.
Gaining consent from a parent or guardian upfront is hugely important here. This is because, once the advice firm has begun processing the data of a child as part of the advice process for their parent or parents, the ongoing processing of their data falls under ‘legitimate interests' as it will be required for the continuation of the service offered by the advice firm to the client.
The Information Commissioner's Office has paid special attention to children under the GDPR, with information commissioner Elizabeth Denham writing in a blog that consent for processing data on children "will not always be required - organisations may be relying on a different basis for processing (such as legitimate interests) and it may be that a different basis is better for both the data controller and the child."
Denham also noted: "Fairness, transparency and accountability are essential for all data processing, but this is especially relevant when children are accessing online services. Anyone offering online services to children will have to ensure that they are addressed in plain, clear language that they can understand."
While it is unlikely children will be accessing the online services of financial advisers, the broader point is that, if their data is collected at any stage, it must be paid special attention. It will not be well-received if a child's data is left with a financial advice firm at the beginning of an advice process that does not go anywhere - in other words, no contract is ever entered into, yet the advice firm continues to process the data and submits marketing material to the child.
Potential banana skin
The potential banana skin here is that, while consent to receive marketing material may have been granted by the adult in the process before the child's 13th birthday, once the child turns 13 the advice firm would need to recapture consent from the child to market to them.
This may seem like a farfetched scenario but it is one that can easily creep up on a firm. It is important, therefore, to put further measures in place for processing data on children.
Given the nature of the work financial advice firms do, it would be best carefully to consider whether or not processing data on children outside of the grounds of legitimate interest, performance of a contract or being in a position to defend a legal claim, is really worthwhile.
Rob Walton is chief operating officer at Intelliflo
