The Danish privacy regulator Datatilsynet has reprimanded 51 Danish municipalities for using Google’s products in primary schools.
Specifically, this concerns Google Chromebooks and Google Workspace for Education.
Dozens of Danish municipalities use Google products in primary education. In this situation, the municipalities are the data controllers, and Google is the data processor.
In turn, Google uses a chain of sub-processors: businesses hired by Google to handle the personal data of its clients. However, these firms are located outside of the EU. That means that municipalities must demonstrate that any such transfers maintain a level of protection equivalent to that provided within the European Economic Area (EEA).
Without such safeguards, data flows could be considered unlawful.
Two years ago, Datatilsynet asked the European Data Protection Board (EDPB) about the data controller’s obligations when using data processors and sub-processors outside the EU. The EDPB stated that the controller must have a complete overview of all processors and sub-processors, their roles, locations, and compliance with GDPR rules, including rules on international data exchange.
The Danish privacy and data protection authority found that the municipalities, in their role as data controllers, did not comply with GDPR obligations.
For example, the municipalities failed to verify whether the sub-processors Google works with comply with the processing agreement, particularly regarding the transfer of data to third countries. According to the regulator, contractual obligations don’t suffice for data transfers to unsafe countries.
Therefore, the processing of personal data by primary schools does not comply with rules dictated by Europe’s privacy laws.
In addition, Datatilsynet claims that municipalities are likely to violate the GDPR if they use Google products that are not configured correctly. The privacy supervisor also strongly criticizes the processing of personal data by municipalities when using Google products for teaching in primary education.
The municipalities involved don’t get sanctioned by the privacy regulator, but they are reminded that they must have sufficient resources and clarity in their data processing arrangements, especially when service terms change or evolve.
Unlock more exclusive Cybernews content on YouTube.
Your email address will not be published. Required fields are markedmarked