age, gender, disability, nationality and cause for detention. One may not forget that the scope of gathered data should be closely related to the specificity of the area concerned, e.g. in the context of migration public authorities should, in addition, record information on the child’s migration or displacement status21, whether the child is accompanied by a legal guardian and so on. 2.3 Data Privacy and Data Protection Any personal data (in particular biometric data) should be collected and processed in line with the right to privacy and the principle of confidentiality.22 Any data collection procedures or further processing (including sharing and granting access to the data) should be strictly regulated and with proper safeguards in place. In this respect, States should take all appropriate measures to ensure that the amount of data collected is limited to the minimum necessary for the specific purpose (so-called data minimisation) and the retention period does not exceed the legitimate needs.23 At the same time, every child concerned should be adequately informed and able to exercise control over his/her personal data. Without providing adequate privacy and confidentiality guarantees, certain categories of information may remain severely underreported, e.g. drug use or disability.24 Until children have the capacity to make fully informed decisions on this matter, parents or caregivers should be involved in the management of the child’s data. The existence of a parental (caregiver) bond should not, however, deprive the child of the right not to disclose certain categories of information about himself or herself to a parent (primary caregiver) despite disclosing them to the personnel of a detention facility. For instance, in the Australian state of Victoria, prison staff is responsible for taking all reasonable steps to ensure that in their interactions with family and friends (e.g., in the processing of visits), the information on gender identity of a detainee is not disclosed if the detainee advised so.25 21 CRC-Committee, Concluding observations: United Kingdom of Great Britain and Northern Ireland, CRC/C/GBR/CO/5, 2016, para. 77(a). CMW-Committee, Concluding observations: Honduras, CMW/C/HND/CO/1, 2016, para. 41. 22 OHCHR (2018), op. cit., p. 16. Data privacy refers to the one’s informational self-determination (right to exercise effective control over one’s personal data), e.g. right to not disclose certain data, right to be informed. The concept of data protection, on the other hand, refers to the obligations of data collectors/controllers to ensure security of stored data. According to the principle of confidentiality, the data controller is responsible for the protection against unlawful and/or unauthorised access, disclosure or theft of personal data. 23 UN Development Group, ‘Data Privacy, Ethics and Protection. Guidance Note on Big Data for Achievement of the 2030 Agenda’, 2017, p. 6. 24 For the general challenges in collecting data from prisoners see: Zoltán L. Apa et al., ‘Challenges and strategies for research in prisons’, Public health nursing, Boston, Vol. 29(5), 2012, pp. 467-72. 25 Corrections Victoria Commissioner, Management of Prisoners who are Trans, Gender Diverse or Intersex, 2019, Available at https:// www.corrections.vic.gov.au/sites/default/files/embridge_cache/emshare/original/public/2019/04/af/aef1f4a78/2.4.1_mgt_trans%2Bgenderdiverseintersexv8.docx (accessed 15 September 2019). 47