Data privacy on new current account for a child

LockdownMadeMeMad

I am opening a current account for my daughter who is about to go into year 7. She is 11 now so needs my (or my wife's) authorisation to open an account. I've started this process with a bricks and mortar UK bank (not where we bank as part of their Covid response has been to stop opening child accounts), and we visited their branch in our town a couple of weeks back to provide all the required identity docs. Everything is in order but with school starting soon I wanted to know that we're going to get the account and bank card etc in good time. So today I rang the help line with the reference number, and was told that whilst I can satisfactorily identity myself, they can't talk to me about the progress of the application without getting my daughter to answer some security questions! How can this be the case that she is under the age of 'digital consent' (16), too young to open her own account with any UK bank (14) and they needed *my* identity to start the application process in the first place! Does anyone else think this is bonkers?

jonesMUFCforever

Name the bank please - someone on here will know the procedures for various banks.

Sandtree

According to the ICO the age of consent on digital privacy is 13 not 16 https://ico.org.uk/for-organisations/guide-to-data-protection/key-data-protection-themes/children/

If you look at the further guidance on https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-gdpr/what-rights-do-children-have/ life gets a lot more complicated ...

How does this work in practice?

An adult with parental responsibility may seek to exercise any of the child’s rights on their behalf.

If you are satisfied that the child is not competent, and that the person who has approached you holds parental responsibility for the child, then it is usually appropriate to let the holder of parental responsibility exercise the child’s rights on their behalf. The exception to this is if, in the specific circumstances of the case, you have evidence that this is not in the best interests of the child.

If you are confident that the child can understand their rights, then you should usually respond directly to the child. You may, however, allow the parent to exercise the child’s rights on their behalf if the child authorises this, or again if it is evident that this is in the best interests of the child.

So whereas initial consent to processing of data as a set age limit subsequent to that it is for the organisation to determin if the child is competent in understanding the situation... if they are then the child has to give consent, if they arent then parents can access without consent.