Citing article 8 of the GDPR (emphasis added):
- Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.
Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
So member states can define a different age, even though the GDPR says that it should be 16. But is this an exception? Are there any other exceptions? Must these exceptions be explicitly stated in the GDPR? I'd like to understand to what extent the GDPR must be followed by member states, and to what extent it could be amended in national laws.