During the 46th Global Privacy Assembly held at the end of October in Jersey, the Office of the Privacy Commissioner for Bermuda (PrivCom) joined the UK Information Commissioner’s Office (ICO) and other global data protection and privacy authorities and regulators in signing the Joint statement on a common international approach to age assurance. PrivCom has also joined the International Age Assurance Working Group that meets regularly to share information on age assurance and learn from research, policy development and enforcement action.
“Under Bermuda’s Personal Information Protection Act 2016 (PIPA), a child is defined as an individual under the age of 14. Children’s personal information enjoys increased protection under PIPA. Organisations providing digital or electronic services that use personal information about children must obtain verifiable consent from a parent or a guardian before they collect or otherwise use that information. They also must display easily understandable privacy notices, establish age verification procedures and ensure that no sensitive personal information is elicited from a child,” said Commissioner White.
Age assurance is the process of establishing, determining, and confirming either an individual’s age or an age range. It is an umbrella term encompassing all methods that help estimate or assess a user's age and therefore allows providers to tailor user experience to the user’s age, or to enforce age-appropriate access restrictions, where legally required. Age assurance can play an important role in keeping children, and their personal information, safe online.
The statement is the first of its kind in terms of international cooperation with the objectives to safeguard and empower people and to empower responsible innovation and sustainable economic growth. Setting out key shared principles for the signatory regulators, it is intended as a guide to industry to encourage increased policy coordination and improved regulatory clarity for companies operating internationally regarding shared expectations on privacy-related age assurance practice. In a common effort to protect children’s privacy in Bermuda and globally, which leads us towards a more common international approach to the data protection and privacy implications of age assurance methods, providers and the suppliers of age assurance services are urged to take account of these principles in their approach to age assurance, whether they operate in Bermuda or in other jurisdictions.