Report on the IMKR Lecture “Data and Asset Protection for Children and Adolescents When Using Smartphones” by PD Dr. Kramme
On June 9, 2021, Priv.-Doz. Dr. Malte Kramme, interim professor at the University of Siegen, spoke on the topic of “Data and Asset Protection for Children and Adolescents When Using Smartphones.” After Prof. Rösler’s welcoming remarks, Dr. Kramme began by outlining the risks to which minors are exposed when using apps. These risks include, among other things, threats to privacy resulting from the disclosure of personal data and threats to the financial interests of minor users. The protection of minors therefore follows both the provisions of data protection law and those of the German Civil Code (BGB). Nevertheless, these two areas of law provide for different regulations and instruments. Dr. Kramme therefore explained how the protection of minors – which is structured differently in these two areas – can be coordinated to create a clear legal framework for children, adolescents, and their parents regarding the use of apps.
In data protection law, Article 6(1) of the GDPR establishes a general prohibition of data processing subject to permission. Dr. Kramme identified the most important legal bases as data processing based on consent (lit. a), data processing for the performance of a contract (lit. b), and data processing to safeguard the legitimate interests of the controller (lit. f). However, the commercial use of minors’ data is not necessary to fulfill the app usage agreement and therefore cannot be justified under Article 6(1)(b) of the GDPR. Data processing in the legitimate interests of the app provider under Article 6(1)(f) of the GDPR is ruled out in any case for telemedia services – that is, for apps that transmit and process data during use. In this context, § 15(3) of the German Telemedia Act (TMG) (or Art. 5(3) of the ePrivacy Directive) takes precedence. However, even within the scope of the GDPR, the commercialization of minors’ user data does not fall within the legitimate interests of the app provider. Consequently, the admissibility of data processing for commercial purposes under data protection law generally depends on consent pursuant to Article 6(1)(a) of the GDPR. In Germany, minors aged 16 and older may validly consent to data processing under Article 8(1) of the GDPR. For those under 16, parental consent is required.
Dr. Kramme contrasted data protection provisions for minors with the regulations of the German Civil Code (BGB). Minors under the age of seven are legally incapable of entering into contracts under § 104 No. 1 BGB. From the age of seven, minors have limited legal capacity under § 107 BGB and may only enter into transactions that are solely legally advantageous to them. Dr. Kramme explained that when “paying with data,” the app user commits to permitting data processing. Accordingly, the transaction is no longer merely legally advantageous. It therefore depends on parental consent and remains provisionally ineffective until such consent is given (§ 108 BGB).
Dr. Kramme then pointed out that the assessments regarding the protection of minors in data protection law and in the BGB are not entirely consistent. From the perspective of data protection law, minors aged 16 and older can validly consent to data processing and thus pay with data. However, under the provisions of the BGB, they could not validly enter into the underlying contracts without parental consent. The consent would thus be given without a legal ground. To align contract law with data protection law, Dr. Kramme proposed an analogous application of § 110 BGB (the so-called “pocket money provision”) to “paying with data.” A direct application would fail because, unlike pocket money, for example, data is not provided to minors by their parents or third parties. However, given the function of data as a means of payment, the analogy is warranted. For young people aged 16 and older, this would ensure consistency between the assessments under data protection law and contract law. They would then not only be able to validly consent to the processing of their data under Article 6(1)(a) of the GDPR, but also enter into the underlying app usage agreement.