Analysis. Using Google Workspace and Google Chromebooks in European schools is cheap and convenient and a lot of teachers and students love it, as they already know the system and tools, which work so well. But to do it legally is very very hard and it might even be impossible – and ethically it is impossible. The case is a hot topic in Denmark, who is going through same troubles they ran into last year in Holland.
Probably half of the Danish primary schools uses Google Workspace (formerly ‘Google Suite for Education’). The green light was given by the Danish Data Protection Agency in 2017 to use the core of Google Workspace (Gmail, Hangouts, Chat, Meet, Docs, Sheets, Slides, Drive). But it demands that you do proper risk and consequence analyses, make the right agreements with Google and turn off various services in the settings in the right way. The Danish municipality Helsingør did not do it right, and thus the Danish DPA prohibited the municipality to transfer data to third countries and to use of Google Workspace.
The DPA verdict was published in the middle of the summer holidays (mid July), and created chaos in the many schools using Google Workspace. No municipality has yet found the right way of doing it in their schools and no one has gotten the final approval of the DPA. Other municipalities like Ballerup and Århus believe they’ve done better than Helsingør, but they are also in the queue at the desk of the DPA. Helsingør municipality has sent in a 1700 page risk analysis, which the DPA is now scrutinizing, and the IT-responsible in the municipality Lars Rich says that it is safe enough to continue using the system, as the risk is low, he told Radar – and thus totally ignored that an authority actually demanded that it stop using Google.
The big issue in this case is that Google by default is not compliant with European rules, and if a public authority wants to use it legally, you have to do a lot of turnarounds. And then you can maybe use the core of Google Workspace, but what about the other services, that does NOT comply with the rules, and have not been given the green light by the DPA: Google Search, Maps, Chrome and Youtube? To use them the kids have to log out of their Google school account, and then they’ll be tracked and profiled by Google, and should authorities promote that? And what about those under 13 who are not supposed or allowed to use any of these services at all?
Isen’t it a societal duty to let them know that there are other browsers, search engines, maps and translation services than Google?
Learnings from Holland
In Holland, they seem to have found a solution, but it demands new and more promises from Google, who operates with so many different privacy policies that even the Norwegian DPA has a very hard time understanding them.
March last year, a risk assessment in Holland concluded that 8 out of 10 high privacy risks in Google’s productivity suite, Workspace, remained. The Dutch educational institutions then asked the Dutch DPA for advice. At the end of May 2021, the DPA told schools and universities to stop using Google Workspace for Education before the start of the new school year. But according to The Register, they found a solution where Google promised privacy improvements:
“Google, like Microsoft, will become a processor for Diagnostic Data. This means that Google may only process this data about the individual use of the services for the purposes approved by the schools. There are three of these purposes, namely providing and securing the services, as well as keeping them up to date. So Google is not allowed to process the pupils’ and students’ personal data for advertising, marketing, profiling or big data analytics. Google will also develop a data processor version of the Chromebooks and the Chrome browser for business and educational customers.”
In Denmark, Google has only promised schools not to use the kids’ data for advertising. What about all the other purposess, where some of them have been stopped in Holland?
The question is also whether the Dutch solution is good enough, and whether it is a sustainable idea that Holland and Denmark and other European countries bring up their children to be dependent on the surveillance economy. When they leave school, they only know Google’s tools. Isen’t it a societal duty to let them know that there are other browsers, search engines, maps and translation services than Google? Some of them are European and they comply with our laws by default.
The Solution is Not the Surveillance Industry
In Germany, they don’t allow neither Google nor Microsoft in schools. In France they are also working with alternatives to the offers of the surveillance industry. And in Sweden, they’ve set up ‘The Sunet Drive SafeSpring solution’ with Nextcloud, an open source German-based collaboration platform.
So, why don’t the Danes and the Dutch have a meeting with the Swedes in order to make a long-term sustainable educational collaborative system, that is not part of the surveillance industry?
Update: 18th August the Data Protection Agency withheld their decision to not allow Helsingør Municipality to use Google Chromebooks and Workspace