It should be noted that the Act has adopted the United Nations definition of a “child”, being a natural person under the age of 18 years, who is not legally competent.

The authorisation and prior consent required (through the competent person or emancipated minor) for the processing of personal information of a child may come by way of:

• the prior consent of a competent person (being a person legally competent to consent to an action or decision by a child);
• information deliberately made public by the child with the consent of a competent person (legal guardian or emancipated minor); or
• in the other circumstances in which general authorisation concerning special information may apply.

Prohibition on processing personal information does not apply if the processing is:

• necessary for the establishment, exercise or defence of a right or obligation in law;
• for historical, statistical or research purposes to the extent that the purpose serves a public interest sufficient guarantees are provided for to ensure that the processing does not adversely affect the individual privacy of the child to a disproportionate extent
• the personal information which has deliberately been made public by the child with the consent of a competent person

It must be recognised that in certain circumstances legislation will render a child “competent”. Likewise, there are instances in our law which allow a child to open a banking account at the age of 16. The processing of a child’s personal information for this purpose would be regarded as being authorised by virtue of legislation conferring the right on the child.

The responsible party needs to refrain from any action that is intended to encourage or persuade a child to disclose more personal information about him- or herself than is reasonably necessary given the purpose for which it is intended. The responsible party needs to further establish and maintain reasonable procedures to protect the integrity and confidentiality of the personal information collected from children.