This article was published in 2021. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
Educational institutions reach agreement with Google on mitigating high privacy risks
Following intensive discussions in recent weeks, agreement has been reached with Google on mitigating high privacy risks relating to the use of Workspace for Education Plus (formerly G Suite Education for Enterprise) and Workspace Education Fundamentals (the free version, formerly G Suite for Education) by educational institutions in the Netherlands. These high risks came to light in a Data Protection Impact Assessment (DPIA) carried out in 2020 and 2021. Following the results of this DPIA, SURF and SIVON asked the Dutch Data Protection Authority (AP) for advice. In its advice of 31 May, the AP indicated that all high data protection risks must be sufficiently mitigated by the start of the 2021/2022 school year at the latest, otherwise schools must stop using Workspace for Education.
ChromeOS, Google Cloud Platform and other Google services
Most of the agreed measures apply to the core services in Workspace for Education (for example Classroom and Gmail). Google commits to continuing discussions with SURF and SIVON about other Google services that are regularly used in education, such as Google Cloud Platform and ChromeOS (the operating system for Chromebooks).
Next steps
Over the next 2 weeks, SURF and SIVON will continue discussions with Google to refine the negotiation results and reach agreement on how existing contracts will be amended or migrated to the new arrangements. Our aim is to complete this on 21 July. Before the start of the next school year, SURF and SIVON will give educational institutions instructions on how to ensure that these changes apply to their contracts.
In addition to the measures Google has implemented, mitigating the high data protection risks also requires educational institutions to apply the correct administrator settings and certain organisational measures. SURF and SIVON will provide the necessary documentation for workplace administrators to be able to take those measures.
SURF and SIVON will provide educational institutions with a complete package of all the documents and information they need to assess whether the use of Workspace for Education (Plus), taking into account their specific configuration and use of Workspace for Education (Plus), sufficiently ensures the protection of personal data in accordance with the GDPR. More news on this is expected shortly after 21 July.
SURF and SIVON continue to work with Google
Looking at the risks and issues that emerged during the DPIA and the actions Google has taken or announced, SURF and SIVON can confirm that Google is addressing these issues. Given the importance of the use of Google services in educational institutions, SURF and SIVON will continue to monitor Google on behalf of the education sector and to discuss privacy issues with Google. For example, a DPIA will be carried out on the Chrome browser and Chrome OS, and the results will be discussed with Google in a similar way as for Workspace for Education (Plus).
Privacy Direct partner of SIVON
Privacy Direct has been a proud partner of SIVON since 2019. In this context, we have been selected by SIVON to provide data protection officers (DPOs) to secondary and primary education institutions. We do this on request. Would you also like to experience the convenience of our DPO services? Feel free to contact us. Also for having DPIAs carried out.