The Danish information protection authority (Datatilsynet) has issued an injunction regarding student information being funneled to Google done nan usage of Chromebooks and Google Workspace services successful nan country's schools.
The matter was brought to nan agency's attraction astir 4 years agone by a concerned genitor and activist, Jesper Graugaard, who protested really student information is sent to Google without immoderate information astir nan imaginable for misuse aliases nan effect it could person connected those persons successful nan future.
The agency has now decided that nan existent methods of transferring individual information to Google do not person a ineligible ground for each disclosed purposes. Hence, 53 municipalities crossed Denmark must set their information processing practices.
Specifically, municipalities are ordered to:
- Cease nan transportation of individual information to Google for circumstantial purposes aliases get a clear ineligible ground for specified transfers,
- Analyze and archive really individual information is processed earlier utilizing devices for illustration Google Workspace, and
- Ensure that Google refrains from processing immoderate information it receives for non-compliant purposes.
The agency clarified that permissible uses of student information see providing nan acquisition services offered by Google Workspace, enhancing nan information and reliability of these services, facilitating communication, and fulfilling ineligible obligations.
Non-permissible cases are purposes related to maintaining and improving Google Workspace for Education, ChromeOS, and nan Chrome browser, including measuring capacity aliases processing caller features and services for these platforms.
"Today's IT services often usability successful specified a measurement that nan transportation of individual information is built into nan product, and that nan usage of nan accusation is often a prerequisite for getting nan afloat use of nan products' functionality," stated the agency's IT information and rule specialist, Allan Frank.
"However, this does not ever hap pinch capable attraction connected nan protection of nan citizens whose accusation is used."
"But neither nan functionality of nan solutions you want to use, nan supplier's marketplace position, nan standardized structure, aliases nan specified usage of a modular merchandise tin warrant not complying pinch nan rules connected information protection, which it has been decided from a governmental constituent of position that we must person successful Europe."
The authority's determination doesn't straight construe to a prohibition connected Chromebooks, which are wide utilized successful Danish schools, but it imposes important restrictions connected really individual information tin beryllium shared pinch Google.
Also, fixed that restricting delicate information processing connected Google's extremity will beryllium hard, if not impossible, for municipalities to assure, location whitethorn beryllium nary applicable measurement to adhere to nan caller policies without blocking nan usage of Google Chromebooks and/or Google Workspace.
Municipalities person until March 1, 2024, to state precisely really they intend to comply pinch Datatilsynet's bid and until August 1, 2024, to afloat align their information processing practices pinch nan caller requirements.
Although group successful Denmark and elsewhere welcomed the agency's announcement, many noted the unnecessarily agelong clip it took nan authority to scope a decision, which was 4.5 years.
Additionally, observers person pointed retired that nan mediocre practices identified successful nan agency's study person persisted for astatine slightest a decade and should warrant fines aliases different corrective measures for those responsible.