Essentially what would have to happen is that, first of all, an individual would be looking to actually direct the relationship of their data. By and large, what we're talking about here is recourse and rights. Let's imagine that it was the right to deletion or the right for data mobility. The company would be receiving direction from a 14-, 15-, 16- or 17-year-old in this particular case, who says, “I want you to do something with my information.”
In the vast majority of cases, those rights and recourses aren't the primary uses of personal information. It's usually the relationship to consent, and you've provided that essentially at outset. This would be wanting to do something with it afterwards. The process would likely be that the individual would seek, via direction to the organization, to say, “I want you to delete my information”, or “I want you to move my information”.
The company would receive that, and it would only be on some sort of expectation, or maybe belief, that the individual is incapable of being able to make that determination. My guess is that they would initially go back to the individual and indicate, “We're uncomfortable deleting your information because we're not sure you're capable of being able to make this determination.” Then they would need to be satisfied of the capability of the individual to be in line with the law.
The commissioner would only get involved if there were ever an investigation that was of the mind that said, “We believe that you failed to live up to the rights of this individual.” The commissioner would investigate the company's reliance on either an authorized entity or the individual as it relates to the determination made about the personal information.