SURF, SIVON and Google reach agreement Terms of Service Google Chrome

In May 2023, SURF and SIVON reached an agreement with Google on the new Terms of Service (ToS) for the use of Chrome OS and Chrome browser for Chromebooks.

After the institution's administration accepts this agreement and takes control of the Chromebooks, Google will be a processor and the institution's administration will be a processor responsible for the processing of personal data on Chromebooks (running on ChromeOS) and in Chrome browsers (running on Chromebooks). By accepting this agreement and implementing associated measures, you will mitigate privacy risks to students and employees when using Chromebooks running ChromeOS and the Chrome browser.

This agreement has been reviewed and approved - on behalf of SURF and SIVON - by a team of (external) privacy lawyers. Besides accepting this agreement, as an institution you need to take some additional measures to ensure safe use. You will find these measures in brief at the bottom of this article.

Note: these measures are in addition to the measures Google Workspace users were able to take at an earlier stage. Should you want to read back on these steps, check out this page.

The DPIA on Chromebooks, ChromeOS and Chrome browser is separate from the DPIA performed on Google Workspace. You can read more about this in this article.

The Terms of Service in Brief.

• Commissioned by SURF and SIVON, Privacy Company conducted a study on privacy risks when using Chromebooks and Chrome browser on Chromebooks. View the full report here.
• Google is developing a processor version of ChromeOS specifically for education. It will be available in August 2023.
• In addition to the introduction of the processor version, SURF and SIVON have made additional agreements to eliminate privacy risks. These agreements are in the “improvement plan.
• The management of the institution itself also needs to adjust a number of privacy-related settings. These steps can be found in the manual.
• For all users in Dutch education, Google will come up with a new processor agreement. Institutions will receive notice of this from Google as soon as possible. The Chrome OS and Chrome browser processor agreement has been reviewed and agreed upon by SURF, SIVON and privacy lawyers on behalf of SIVON.
• The agreement applies to Chromebooks under management under a Workspace domain. You bring Chromebooks under management with the “Chrome Education upgrade” license.
• The processor agreement applies only to 'essential services' (see the appendix 'List of Essentials Services').
• Optional services must be turned off by the admin.
• There is no need to install new software on the Chromebooks. The rollout of features to enable the processor version are in Google's software updates.

what do you need to do as an institution board itself?

• Make sure all Chromebooks you use are under management within your Workspace domain (the so-called “education upgrade”).
• Accept the agreement Google offers you (how/when).
• Disable all optional services (see manual).
• Implement the remaining measures as described in the manual.

Note that de-activating 'optional services' involves switches. All switches will be implemented in August 2023. Existing Workspace users must deactivate 'optional services' themselves with the switches. For new Workspace users, optional services are off by default ('privacy by design').