Gillick Competence in Information Sharing and Record Access

We were recently asked an excellent set of questions following a Subject Access Request (SAR) webinar where the consent of children and Gillick competency were briefly discussed.

The questions highlighted how easy it is for confusion to arise, particularly around what happens at different ages, whether competence should be “tested” more than once, and how this plays out in real-life examples.

This blog pulls together the discussion and clarifies the key principles for organisations.

What Is Gillick Competence?

“Gillick competence” comes from a 1985 legal case, and it describes when a child under 16 can consent to their own medical treatment (or make decisions about information sharing) if they have enough understanding and intelligence to appreciate the implications of that decision.

The important points are:

• Case by case: competence is not a fixed status.

• Decision specific: a child may be competent to decide about one matter but not another.

• Evolving: maturity and understanding increase with age, and can also fluctuate with circumstances (particularly, the complexity of the decision).

• The judgment established the wider principle: a child under 16 can make their own decisions if they have sufficient maturity and understanding of the consequences - it's not just a healthcare thing.

Common Misunderstandings About Age

People often miss the fact that the legal thresholds differ depending on whether the decision is about information or healthcare.

Information decisions (data sharing, access to records, participation in research):

• 12 years or over: in data protection law, children are generally recognised as having the capacity to consent to decisions about their own information.

• Under 12: Gillick competence should be assessed if the child expresses a view.

Healthcare decisions (treatment, care, clinical consent):

• 16 years or over : young people are automatically presumed competent to make decisions about their own health and treatment.

• Under 16 – Gillick competence should be assessed in relation to the specific healthcare decision.

While age is a useful marker, it is not the whole story. Competence is not automatically “switched on” or “off” at a particular birthday — it always requires a judgement in context.

Do We Need to “Test” Twice?

One of our customer’s concerns was whether Gillick competency has to be tested more than once. The answer is:

• Yes, where relevant: each decision should be assessed on its own merits.

• Not a blanket label: you cannot code or label a young person as permanently “Gillick competent” and apply it to all future decisions.

• Best practice: record the competence assessment at the time of the decision, showing that the child understood the nature, risks, and implications.

Real-Life Examples

Example 1: Access to Records

A father with parental responsibility requested access to his children’s records. The children were 11 and 14, but had not seen their father in years. Both told the GP they did not want him accessing their records and showed clear understanding of the implications. The GP confirmed this to the DPO, and the father’s request was declined.

This illustrates how the children’s voices carry weight when they demonstrate understanding. Age was relevant, but the key factor was their ability to grasp the consequences of their choice.

Example 2: Participation in Research

An 11-year-old wanted to take part in a simple research survey. Parents objected. The practice checked that the child understood what participation involved and the implications. Since the activity posed no harm and was in the child’s interests, the study proceeded.

Here, competence was assessed in relation to the specific decision - a low-risk survey - and the child’s wishes were respected.

Key Takeaways for Organisations

• Gillick competence is dynamic, it is judged individually, not fixed by age.

• Assess understanding, check if the child grasps the nature, risks, and consequences of the decision in question.

• Record clearly: note the reasoning and the child’s demonstrated understanding.

• Respect confidentiality, children capable of making informed decisions have a right to have those decisions honoured, provided no harm arises.

• Safeguarding first, if a decision places a child at risk, parental involvement may still be required.

Emma Kitcher, Privacy Nerd