In which circumstance would a data controller be most likely able to justify processing a child’s data without parental consent?
GDPR Recital 38 recognizes an exception for preventive or counselling services offered directly to a child: consent from the holder of parental responsibility should not be necessary in that context. Marketing is specifically an area requiring heightened protection, and a business interest or educational purpose alone does not create the stated exception.
Community Discussion