Administrative Law Challenges in the Information Commissioner’s Office Age Appropriate Design Code
By Jonathan Collinson (University of Huddersfield)
The Information Commissioner’s Office (ICO) Age Appropriate Design Code is a collection of 15 principles to set expectations of how children’s personal data should be processed in order to be compliant with UK data protection law. Its leading principle is that the “Best Interests of the Child” are the primary consideration when designing and developing online services.
A recent report, which I co-authored with advocacy organisation, Defend Digital Me, examined in particular the question of what the “Best Interests of the Child” might mean in the context of children’s data protection and privacy, and the problems that the ICO is likely to encounter in operationalising this principle. Decision-making on how to balance children’s rights will be new for most businesses. The Code may shift the responsibility for decisions away from parents at the point of their child’s use of digital products, and make it the responsibility of the architects and designers of tools and services, who will predetermine the available choices in a service.
Some of the issues arising from the report are inherent to the ICO’s role as regulator in an administrative law context. The Code is a statutory code of practice aimed at digital service providers to:
enable you to design services that comply, and demonstrate you comply, with the GDPR and PECR. If you do not follow this code, you are likely to find it more difficult to demonstrate your compliance with the law, should we take regulatory action against you. (ICO)
As a regulator, the ICO’s actions are subject to administrative law principles. This blog post focusses on the specific administrative law issues identified in the report: firstly, is the best interests of the child a procedural or substantive right; and, secondly, what does it mean to treat the best interests of the child as a primary consideration?
A procedural or substantive right?
The UN Committee on the Rights of the Child argues that the best interests of the child (BIC) has three dimensions, which it possesses simultaneously: a substantive right, an interpretive legal principle, and a procedural right. A conceptual divide has opened up in the immigration law literature between substantivists and proceduralists. Proceduralists argue that the best way of protecting the BIC is to assess the quality of decision-making. When a decision-maker can show that they have made a careful and informed assessment of the BIC, the reviewing authority will be more likely to accept that the BIC have been met. The assessment isn’t whether the final decision is in fact in the BIC, but instead whether the BIC has been given enough attention and weight in the decision-making process. Proceduralists argue that treating the BIC as only a procedural right leads to more consistent decision-making by reviewing authorities. This is particularly the case when the BIC is one factor amongst others within the balance of pre-existing rights (in the immigration context this is the right to family life).
In contrast, substantivists argue that the BIC ought to be considered as a separate, substantive human right on its own accord. This means that the BIC should be assessed as a relevant factor in decision-making and must be balanced directly against competing interests. The outcome of the balance between different rights and interests can (and should) be directly assessed, not just the way in which the decision is come to.
However, as a domestic regulator, it may well not be appropriate for the ICO to adopt solely a procedural lens for its assessment of the best interests considerations made by digital service providers. The procedural versus substantivist debate in the literature occurs in the context of the supervisory role of the European Court of Human Rights (ECtHR). In that role, the Court has adopted a principle of subsidiarity whereby individual states are able to adopt different public policy responses and the Court will review their conformity with the Convention. Subsidiarity makes sense for the ECtHR because it allows states to make different, democratically endorsed, public policy decisions so long as a minimum rights standard is maintained.
In contrast, the ICO’s role occurs in a different context. Whereas democratic imprimatur leads the ECtHR to tolerate a wide range of different responses to the same public policy challenge, if the ICO permits a wide range of different substantive answers to the same essential questions in digital design, then its decision-making will be inconsistent. It would also potentially afford a competitive advantage to those companies most willing to create a digital product with substantive privacy outcomes which do not support the BIC, but which play the procedural game of appearing to ‘consider’ the BIC. It might be argued that such an approach by a company would be identified by a procedural review because there would likely be a significant disconnect between the procedural ‘consideration’ of the BIC and the substantive outcome. However, identifying such a disconnect can only be achieved by taking a view on what substantive outcome (or at least, range of outcomes) is permissible.
A ‘primary’ consideration
The first principle of the Age Appropriate Design Code is that ‘The best interests of the child should be a primary consideration when you design and develop online services likely to be accessed by a child.’ The risk assessment documentation created by the ICO to support the adoption of the Code also states that digital service providers should ‘Ensure that the best interests and safety of children are a primary consideration in the development of new services’ and ‘Account for the best interests of the child as a primary consideration where any conflict arises’. However, the Code and Risk Assessment documentation both leave the meaning of ‘primary consideration’ substantively unexplored. The Code says that:
The placing of the best interests of the child as a ‘primary consideration’ recognises that the best interests of the child have to be balanced against other interests. For example the best interests of two individual children might be in conflict, or acting solely in the best interests of one child might prejudice the rights of others. It is unlikely however that the commercial interests of an organisation will outweigh a child’s right to privacy.
This provides little actual guidance as to how to conduct a balancing assessment, not least one which treats the BIC as not just a consideration in the balancing exercise, but the primary consideration. Without conceptual certainty, it is impossible to state why it is unlikely that commercial interests will outweigh a child’s right to privacy, and how one is to determine when the unlikely has genuinely arisen. Furthermore, if the ICO conceives of the BIC as being a procedural right, when does a digital service provider adequately consider the BIC as a primary consideration: when the BIC are considered first or when they are given more weight than other considerations?
The Supreme Court, in the immigration context, have found that to treat the BIC as a primary consideration:
This did not mean (as it would do in other contexts) that identifying their best interests would lead inexorably to a decision in conformity with those interests. Provided that the Tribunal did not treat any other consideration as inherently more significant than the best interests of the children, it could conclude that the strength of the other considerations outweighed them. The important thing, therefore, is to consider those best interests first.
It is not, however, the case that considering the best interests first is the same as treating them as a primary consideration, only that by considering them first means that the BIC are likely given adequate attention. As Lord Kerr in another case identified: “[I]t seems to me that there is much to be said for considering those interests first, so that the risk that they may be undervalued in a more open-ended inquiry can be avoided.”
These cases seem to suggest that the nature of a primary consideration is both substantive and procedural. Revision of the Code or supplementary material is likely needed to clarify what the ICO envisage it to mean to treat the BIC as a primary consideration.
The ICO’s approach to the best interests of the child will require transparency of its process to engender trust in its decision-making on the substantive balance of the best interests of the child in enforcement, and second, in its role to regulate the fundamental rights to the protection of personal data.
Dr Jonathan Collinson
Senior Lecturer, Law School, University of Huddersfield, UK