Cybersecurity Policy Report, U.K.’s ICO Reviews Children’s Data Privacy in Financial Services Sector, (Apr 1, 2025)
By Tony Foley
The United Kingdom’s Information Commissioner’s Office (ICO) has carried out a review of the gathering of children’s data from services providing them with savings accounts and prepaid cards.
The review was originally launched in 2022 as part of the ICO’s 2025 strategic plan, in which the agency approached organizations in the financial services sectors to review their information processing activities. It focuses on two main areas: the use of children’s data, and the use of artificial intelligence and automated decision making. ICO also collected organizations’ views about their experiences implementing good data protection practices, as well as compliance challenges, competing legislative or regulatory priorities, and any general data protection concerns. ICO gathered its information from March to September 2024, with more than 40 organizations providing their views.
The review results linked above outline findings on the use of children’s data; the portion of the review on the use of AI and automated decision making in the sector are the subject of a separate report. With respect to children’s data processing, the review outlines findings on the following:
Governance: The measures in place to control the processing of children’s data;
Transparency: The information given to children telling them what their data will be used for;
Use of information: What information is processed, for what purpose, and which lawful basis is used;
Individual rights: How individual rights related to children’s data are handled, whether received from children, parents, or other third parties;
Age verification: The methods used to identify and verify the age of children;
Further contact and marketing: How children are contacted about their accounts and information provided to them about other products or services.
The report summarizes areas of good practice, evidence of risks associated with data protection compliance, and instances in which ICO found that improvements may be necessary to data practices.
News: InternationalLegislation DataPrivacy DataSecurity