Status of Google Workspace DPIA: update privacy measures
In December 2022, SIVON and SURF reported that Google delivered measures to mitigate the risks from the 2021 DPIA within the agreed timeframe. Most of the measures comply with our earlier agreements; Google is now addressing the remaining issues and has indicated it will have them resolved by mid-June.
Institutions will be notified as soon as possible after delivery. They will then also hear whether they may have to make adjustments themselves. Based on the agreements with Google, SIVON and SURF conclude that they need not advise against using Google Workspace.
Google picks up remaining points
In January, SIVON, SURF and a team of external (privacy) experts and lawyers thoroughly examined and assessed the above measures. We shared the results of our analysis with Google last February. Subsequently, intensive discussions took place on a number of important points that have not yet been resolved. Google confirmed in March that they are still resolving these remaining points. SIVON and SURF - in coordination with OCW - have decided that Google will have until mid-June to do so.
Het bestuur van een instelling is eindverantwoordelijk voor een veilig gebruik van (digitale) onderwijstoepassingen; zij besluit welke toepassingen hun instelling gebruikt en onder welke voorwaarden. In het licht van de met Google gemaakte afspraken, raden SIVON en SURF het gebruik van Google Workspace niet af. Instellingen ontvangen zo spoedig mogelijk na de opleverdatum van half juni een volledige analyse van alle maatregelen met daarin uitleg over eventuele acties die het bestuurder zelf kan nemen. De onderwijspartners van OCW, SIVON en SURF blijven – nu en in de toekomst - in nauw contact met Google om in de gaten te houden of Google eventuele risico's wegneemt. SIVON en SURF instellingen op de hoogte zodra er meer nieuws is.
Continuous monitoring of legitimacy of great importance
SIVON and SURF endorse the importance of privacy and strive to embed privacy agreements in contracts with vendors. We therefore attach great importance to the continuous evaluation of (cloud) services and assessing their legitimacy. We keep an eye on changing laws and regulations, periodically test existing contracts against these and adjust them where necessary. In addition, we are in constant dialogue and negotiation with vendors to ensure that services can be used safely and responsibly.
Inform Personal Data Authority
On March 7, 2023, the Personal Data Authority (AP) wrote to OCW to remain vigilant about ensuring privacy when using Google applications. The AP asked OCW to inform it of the state of affairs no later than May 15. Following this letter, OCW has been in contact with the AP. In it, she explained the agreements made between SIVON, SURF and Google and explained that institutions will receive clarity about Workspace for Education by mid-June at the latest.
In conclusion state of play on Google Chromebooks, ChromeOS and Chrome browser
It is worth noting that the above DPIA on Google Workspace is separate from the DPIA conducted on Chromebooks, ChromeOS and Chrome browser. During this separate process, SIVON and SURF reached agreements with Google on a new version of ChromeOS. This modified version will be ready around August of this year. Institutions will be informed about this separately.
