SURF and SIVON address Google on privacy risks

In education, more and more (personal) data is being stored and exchanged digitally. It is important that this is done in a safe and responsible manner. Research commissioned by the RUG and HvA shows that there are privacy risks associated with the use of Google G-suite*.

The risks are in the collection of so-called metadata by Google. SURF and SIVON supported this research and are in talks with Google on behalf of the education sector to ensure that Google removes these privacy risks.

The privacy risks came to light through a so-called Data Protection Impact Assessment (DPIA) to Google G-suite. A DPIA provides insight into how data is collected, what is done with it and what the risks are. The Ministry of Justice and Security commissioned the DPIA to the Google G-suite Enterprise version, and the RUG and HvA commissioned research on Google G-suite Education.

Metadata

Google collects metadata. This is data about the use of Google G-suite, for example. Among other things, this allows Google to see what users click on the most, how long they are logged in, and which Internet pages and searches are used the most. So this is not individual learning results or users' address data.

The collection of metadata need not be a problem if this data is used to enable digital products to be used properly and securely and to work better. However, it is important that this data not be used for other purposes. Also, no more metadata should be collected than necessary. Educational institutions must also retain control over the use of metadata. Thus, they must be able to determine for what (other) purposes that metadata may be used.

Risks

Google sees itself as a data controller rather than a processor. This means that Google believes it may determine for what purpose they collect metadata and in what manner. Google has also included in its privacy agreements that it may unilaterally modify the terms around metadata without asking for consent.

For applications at educational institutions, we find it undesirable that the ownership and responsibility for that data lies with Google. As a result, educational institutions that use Google G-suite can exercise little or no control over what happens to this data. Google explicitly states that it does not use metadata and other personal data in Workspace for Education for advertising purposes or the creation of advertising profiles. However, Google may change the terms unilaterally, so this statement provides no guarantees for the future.

Follow-up steps

At this time, there is no agreement with Google on the indicated areas for improvement and we are still in discussion. We are also submitting a request for an opinion on these privacy risks to the Personal Data Authority. We assume that Google will make adjustments so that the identified risks are removed and G Suite for Education can be used safely.

*G Suite for Education has recently been renamed Google Workspace for Education. Google Workspace for Education includes Classroom, Meet, Gmail, Calendar, Drive, Docs, Sheets, Slides and more.