0

Citing article 8 of the GDPR (emphasis added):

  1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.

So member states can define a different age, even though the GDPR says that it should be 16. But is this an exception? Are there any other exceptions? Must these exceptions be explicitly stated in the GDPR? I'd like to understand to what extent the GDPR must be followed by member states, and to what extent it could be amended in national laws.

Improve this question

1 Answer 1

Reset to default
3

Note that the answer to most of your questions has nothing to do with the GDPR specifically, but has to do with the legal force that an EU Regulation has. Here's a related answer on EU Regulations vs. Directives. That said, here are my answers to your specific questions:

So member states can define a different age, even though the GDPR says that it should be 16. But is this an exception?

Yes.

Are there any other exceptions?

Yes. Scanning the Regulation for instances of "Member State" is a good way to find them. In my opinion, the biggest area of the GDPR where Member States have influence is Article 6, "Lawfulness of Processing". In some circumstances, it allows Member States to specify what could be considered a lawful basis for processing.

Must these exceptions be explicitly stated in the GDPR?

Yes. As a Regulation, exceptions must be explicitly stated in order to be permissible because Member States have no authority to overrule EU law*.

I'd like to understand to what extent the GDPR must be followed by member states, and to what extent it could be amended in national laws.

"Amended" is a fuzzy term. It can mean adding, changing, or removing from the law. Unless otherwise specified, Member States could not change or remove provisions, but there could very well be additions consistent with the GDPR.

*Some Member States dispute this statement when it comes to constitutional issues.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .