Children’s Data Provisions

Draft v2 — published temporarily while this policy is pending Board adoption.

Additional safeguards for the personal data of members and contacts aged 16–17, read alongside the Privacy Policy, Data Protection Policy and Safeguarding Policy.

Document Control

Change History

Website History

Contents

1. Who this covers

UYN’s membership starts at age 16. This policy sets out the extra protections that apply to members aged 16–17 (legally children under the Children Act 1989) and to any other under-18 whose data UYN holds incidentally, for example an emergency contact or a sibling named on a form. It does not apply to mentors, volunteers or employer contacts, who are required to be adults.

2. Principles

• The best interests of the young person come first in every decision about their data.
• Young people aged 16–17 are treated as having rights of their own over their data, and are given privacy information they can understand.
• We collect the least data we can, and make sensitive fields optional.
• We involve parents and guardians where the law or good practice requires, without taking away the young person’s voice or putting them at risk.
• Safeguarding always takes priority over confidentiality, and information is shared on a need-to-know basis.

3. Parental / guardian consent

For members aged 16–17, UYN’s Registration Forms Pack (Member) includes a Parent/Guardian Consent block, completed at registration. Parental consent covers participation in UYN programmes and events, the processing of the young person’s personal data for that purpose, and (where relevant) the use of photographs or case studies (section 7). Consent can be withdrawn at any time by the parent or guardian, or by the young person on turning 18.

Parental consent for participation does not remove the young person’s own rights. The young person is also asked to confirm their own understanding and agreement in age-appropriate language, and their own choices on optional matters (photos, sharing with employers, marketing) are recorded separately.

4. Age of consent for online services

The Data Protection Act 2018 sets the UK age at which a child can consent to their own data being processed for “information society services” (online services offered directly to a user) at 13; below that age, parental consent is required for consent-based online processing. Because UYN’s membership begins at 16, this threshold is not expected to be directly engaged by our own registration process. It is included for completeness and in case UYN’s programmes expand to a younger age group in future, which would require a full review of this policy first.

5. ICO Age Appropriate Design Code (“Children’s Code”)

As a precaution UYN will apply Children’s Code good practice to any part of the site a 16–17-year-old member would use:

• high privacy settings by default;
• no profiling for marketing purposes directed at under-18s;
• no “nudge” techniques that encourage young people to share more data or weaken their privacy settings;
• no geolocation tracking by default;
• privacy information written in clear, age-appropriate language;
• data protection impact assessment for any new feature likely to be used by under-18s.

6. Rights of 16–17-year-olds over their own data

In England, a young person aged 16–17 is generally presumed able to understand and exercise their data protection rights. This means that:

• a member aged 16–17 can make a subject access request, ask for correction or deletion, object to processing and withdraw consent in their own name;
• we will explain how to do this in plain language, and offer help from a member of staff or their mentor if they want it;
• a parent or guardian can act on their behalf only with the young person’s consent, or where we are satisfied that the young person lacks the understanding to do so (see Data Protection Policy, section 9.2);
• if a parent or guardian asks for information about a member, we will normally ask the young person first, unless there is a safeguarding reason not to.

7. Photographs, case studies and marketing

Photographs, videos or written case studies featuring a member aged 16–17 are used only with specific, separate consent from both the young person and their parent or guardian, clearly explaining how and where the material will be used (for example website, social media, funder reports) and for how long. Consent can be withdrawn at any time, and material will be removed from future use (though UYN cannot recall material already shared by third parties before withdrawal). Where possible we will use first names only, or no names, and we will never publish a young person’s address, school or workplace, or details of their housing situation, mental health or safeguarding history.

8. Communications with young people

• Mentors and staff communicate with members aged 16–17 only through UYN-approved channels, not personal social media accounts or personal messaging apps.
• Messages relating to a member’s wellbeing or safeguarding are recorded on UYN’s systems.
• Marketing messages to under-18s require their own opt-in, and we do not send marketing based on profiling.
• Where a member turns 18 during the programme, the parent/guardian consent block lapses for future decisions, and we will ask the member to confirm their own choices.

9. Sharing information about young people

• Information is shared with mentors only so far as they need it to support the member.
• Information is shared with employers and training providers only with the young person’s specific consent and, for a member aged 16–17, a parent/guardian’s awareness where appropriate.
• Information may be shared without consent with local authority children’s services, the police or other agencies where this is necessary to protect the young person (see the Safeguarding Policy). UK data protection law does not prevent sharing for safeguarding purposes; the Data Protection Lead and Safeguarding Lead will record the decision and its reason.

10. Extra security and retention for children’s records

Records containing a 16–17-year-old member’s personal data are subject to the same restricted “need to know” access as safeguarding records (Data Protection Policy, section 15), and any safeguarding content is retained in line with the safeguarding retention period (Data Protection Policy, Appendix 2), reflecting the additional duty of care owed to a young person’s data. Identifiable outcome data about under-18s is anonymised as early as is practicable.

11. Monitoring and review

The Data Protection Lead and Safeguarding Lead will review this policy annually, and after any incident involving a young person’s data, and will report to the Board.

Upsurge Youth Network · Children’s Data Provisions · Draft pending Board adoption  ·  Page