Denmark banned Google services in its schools, after last year officials of the municipality of Helsingor were ordered to carry out a risk assessment of the processing of personal data by Google.
TechCrunch reports:
The results of a survey published on last week, Denmark's data protection agency, Datatilsynet, revealed that data processing carried out by students (and not only) using Google's Workspace software suite (a subscription cloud service that includes Gmail apps, Google Docs, Calendar and Google Drive) “does not meet the requirements” of the European Union GDPR personal data protection regulations.
Specifically, the authority found that Google's data processing agreement, or terms and conditions, allow data to be transferred to other countries for the purpose of providing support, even to data normally stored in Google's data centers in the EU.
The laptops Google Chromebooks and by extension Google Workspace are used in schools across Denmark.
However, Datatilsynet specifically focused on Helsingor for its risk assessment after the municipality reported a “breach of personal data security” in 2020.
So while this latest research technically only applies to schools in Helsingor at the moment, Datatilsynet says that many of the conclusions it has reached "probably apply to other municipalities" that use Google Chromebooks and Workspace.
He added that he does not expect these other municipalities to "proceed with the relevant steps" after the decision taken by the municipality of Helsingor.
A Google spokesperson told TechCrunch:
"We know that students and schools expect that the technology that they use is legally compliant, responsible and safe. That's why for years, Google has invested in privacy best practices and diligent risk assessments. It has made our documentation widely available so anyone can see how we help organizations comply with GDPR.
Schools have their own data. We only process their data in accordance with thefundamentals that we have with them. In Workspace for Educations, student data is never used for advertising or other commercial purposes. Independent organizations have audited our services and we keep our practices under constant review to maintain the highest possible standards of safety and compliance."
