Denmark bans Chromebooks and Google Workspaces in schools over data transmission risks TechCrunch
Denmark is effectively banning Google services in schools, after officials in the city of Helsingr last year command to perform a risk assessment around Google’s handling of personal data.
In one The verdict was announced last weekThe Danish data protection authority, Datatilsynet, revealed that the processing of data involving students using Google Cloud-Based Workspace Suite – includes Gmail, Google Docs, Calendar and Google Drive – “does not meet the requirements” of EU GDPR Data Privacy Regulation.
In particular, the authority found that the data processing agreement – or Google’s terms and conditions – appeared to permit the transfer of data to other countries for the purpose of providing assistance, although data is typically stored in one of Google’s data centers in the European Union.
Chromebook laptops by Google and by extension Google Workspace, used in schools across Denmark. But Datatilsynet focused specifically on Helsingør for risk assessment after the city reported a “personal data security breach” in 2020. Although this latest ruling technically only applies to businesses school in Helsingør, Datatilsynet notes that many of the conclusions reached will be “applicable to other municipalities” using Google Chromebooks and Workspace. It added that it expects other municipalities to “take relevant steps” following the decision it reached in Helsingør.
The ban is effective immediately, but Helsingør has until August 3 to delete user data.
Data Flow
The heart of the matter now no longer exists EU-US Privacy Shield regulates how data can be shared between the European Union and the United States. While a new data flow agreement agreed in principle, it has yet to take effect, which leaves many organizations in limbo. As a result, Big Tech companies are relying on standard contractual terms for their data processing activities.
A Google spokesperson told TechCrunch:
We know that students and schools expect the technology they use to be legal, responsible and safe. That’s why over the years, Google has invested in privacy best practices and careful risk assessment, and made our documentation widely available so everyone can see how. we help organizations comply with GDPR.
Schools own their own data. We only process their data according to our contract with them. In Workspace for Education, student data is never used for advertising or other commercial purposes. Independent organizations have audited our services and we keep our practices under constant review to maintain the highest possible safety and compliance standards.
This latest announcement comes after local data watchdogs At France, Italy and Shirt ruled that websites using Google Analytics to track visitors violated European data privacy rules, as personal data was transferred to the United States for processing. And Ireland’s Data Protection Commission (DPC), meanwhile, currently pondering how Facebook’s parent company, Meta is moving data between Europe and the US, which could affect how Europeans can access services like WhatsApp and Instagram.
With European lawmakers eager to establish a higher level of digital sovereignty, Google has been strengthening its platform and infrastructure to help ensure public and private institutions stay. with the company. A few months back, Google announced that it will roll out new “sovereign control” to Workspace users in Europe, allowing them to “control, limit and monitor data transfers to and from the EU”.
However, these controls won’t be made available until later this year, with additional data controls coming throughout 2023. And it’s not clear at this early stage whether the companies will. Is this new instrument watertight in terms of GDPR compliance?
