Children under the IP Act

Queensland government agencies¹ are required to comply with the privacy  principles² in the Information Privacy Act 2009 (Qld) (IP Act) when dealing with personal information. Personal information defined in the IP Act as:

...information or an opinion, including information or an opinion forming part of a database, whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.³

This guideline explains how the IP Act deals with children and parents, who will generally need to exercise the child's rights under the IP Act on their behalf.

Parents' rights under the IP Act

The IP Act defines a child as an individual under 18 years old and a parent as:

• the child’s mother or father
• a person exercising parental responsibility, including a guardian; and
• a person who, under Aboriginal or Torres Strait Islander tradition or custom, is regarded as a parent of the child.⁴

Section 196 of the IP Act states that a child’s parent can do anything under the IP Act that a child could do if that child were an adult. This section is most commonly used to:

• make an access or amendment application on behalf of a child⁵
• act on behalf of a child under the privacy principles; or
• make a privacy complaint on behalf of a child.⁶

The parent does not require the child's permission or involvement to rely on this section.

Recognising children's privacy interests

Agencies must handle personal information in accordance with the privacy principles, and personal information and the privacy principles apply equally to children and adults.

However, the IP Act recognises that children may be unable to make decisions about what agencies can do with their personal information and gives that power to their parents. Despite that, children have privacy rights in relation to their personal information. As far as possible, especially for older children, they should be given the opportunity to make decisions about those rights and how agencies deal with their personal information.

As a general rule, children will have the capacity to make decisions about what happens to their personal information when they have sufficient understanding and maturity to understand what an agency is proposing. There is no set age at which this happens, and agencies should consider whether a child has this capacity on a case-by-case basis.

Parental identity

Before allowing a parent to act on behalf of a child in relation to a child's personal information, agencies must ensure they are satisfied about the parent's identity and their relationship to the child.

The IP Act requires specific documentation for access and amendment applications made by a parent on behalf of a child.⁷ For other matters, agencies can use their discretion—for example, there may be adequate information in existing records—but must ensure they have sufficient evidence about the parent's identity and relationship to the child.