Article 8 paragraph 3 - What does this mean?

[Akirin00]

What does this mean please?

"Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child."

Also, if a UK controller has data subjects in an other EU country, can they apply the UK age rule to all or do they have to go according to each Member State's decision?

Thanks

[Krom]

Art 8 §3 means that if a Member State has different contract regulations regarding contracts with minors ("a child"), those are unaffected by GDPR and still valid. As far as I understand, such clarification paragraphs are required because of the specific provisioning of a regulation in the EU, which becomes effective without needing to be transposed into national laws, thus generating potential conflicts with national law.

Without knowing the specifics of the UK age rules, my understanding is that if the UK controller is offering his services to data subjects in the EU, he would need to comply with the national consent age of the data subjects. Since EU countries have varying consent age requirements (13, 14, 15 and 16 years), I know of a few controllers, most notably WhatsApp, that chose to go with 16, the strictest requirement.

Mircea - CISSP