IE 11 Not Supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Naughty or Nice: Is Santa Putting Children's Information at Risk?

Data protection laws lay down strict conditions for the use of personal data and there is no evidence that Santa Claus has an adequate compliance program in place.

Santa Claus could be breaking privacy laws in his collection and use of data about children, experts have warned. Yuletide cheer-bringer Claus could be putting the personal data of millions of children at risk.

Data protection laws lay down strict conditions for the use of personal data and there is no evidence that Claus has an adequate compliance program in place.

Children across the world who write letters to Claus with a list of gift requests are not told for how long that data is kept, or if it will be used for other purposes such as marketing by third parties.

The U.K. Data Protection Act, for example, stipulates that data should not be kept for longer than necessary, which would mean December 25th, though Claus may argue that he needs to keep the letters for six years to use in any gift-related lawsuits.

"There is a stream of questions Santa has yet to answer," said William Malcolm, a data protection specialist at Pinsent Masons, the law firm behind Out-law.com. "Is this information used for anything other than present giving? Information passes out of the EU, so does Santa check the letters for unambiguous, specific and informed consent to this overseas transfer?"

Out-Law's attempts to put the questions to Claus were hindered by the lack of an office chimney. Eventually the questions were put up a domestic chimney but no response was received by time of publication.

The U.K. Data Protection Act says that you must inform someone when you are collecting data about them, and tell them what the purpose of collection is.

"What about the naughty/nice database?" said Malcolm. "Are children given notice that behavioral data is being collected about them throughout the year? And does it qualify as covert monitoring, which would breach Article 8 of the European Convention on Human Rights?"