Instagram investigated over handling of children’s data

Ireland’s Data Protection Commissioner (DPC) is investigating social media giant Instagram over the use of the personal data of children.

As the European Union’s lead regulator for data protection, the DPC has launched two separate inquiries into Instagram’s parent company Facebook, which focus on certain legal aspects and the ‘appropriateness’ of its profile and account settings for users.

Large fines could be imposed on the company if they are adjudged to have broken regulations. Users of Instagram must be aged at least 13 to open an account.

‘Protecting the rights of children as vulnerable persons’

The DPC says it is vital that data controllers are compliant with the regulations under the EU’s General Data Protection Regulation and the Data Protection Act 2018, and it has launched these investigations after ‘actively monitoring complaints received from individuals’.

The first inquiry will assess Facebook’s ‘reliance on certain legal bases’ for its processing of children’s data on Instagram, and will aim to establish whether Facebook has a ‘legal basis’ for its actions, and whether it employs adequate protections and/or restrictions on data use.

Second, the DPC will also examine the profile and account settings put in place by Instagram, and the appropriateness of them for children and young people. This aspect of the investigation will also look at whether Facebook has adhered to GDPR requirements, and specifically in the context of protecting the rights of children as vulnerable persons.

Facebook has so far not yet publicly commented on the investigation.