All about DPIA Google Workspace
On July 8, an agreement was reached with Google on measures aimed at the previously identified privacy risks at Google Workspace for Education. This means that schools can continue to use Google Workspace for Education, provided they implement some actions themselves.
This is the result of intensive discussions that SURF, SIVON and the Strategic Supplier Management Rijk (SLM-Rijk), partly at the request of the PO-raad and VO-raad, have held with Google.
The agreements include a comprehensive set of contractual, organizational and technical measures. These adequately cover the high privacy risks identified by the Personal Data Authority on May 31, 2021.
This statement by SURF and SIVON describes this achieved result. Google will start working on technical adjustments but schools will also have to carry out some actions themselves to (continue to) use Google securely. SIVON and SURF will provide support in this by means of a manual.
Actions for institutions
Adjust settings: in addition to automatic changes in the application, your own system administrator will also have to adjust some settings in the Workspace environment. A manual for this will be available in the first week of August.
Supplement instructions: the safe use also requires explanation to the users. Not everything can be arranged technically but will have to be done through user instructions. These will also be centrally available in the first week of August.
Adjust contract: no later than the first week of August information will follow on how to accept the adjusted privacy terms with Google. Again, this is a one-time activity.
Do its own impact analysis: the institution remains responsible for assessing whether the way Google Workspace for Education (Plus) is used is secure. No later than the first week of August, a package will follow with everything needed to do such an assessment.
The amount of work per institution will depend on how many Google applications an institution has in use, but is expected to take from 1 to several half-days.
DPIA on Chrome browser
Together with SIVON, we are still working on an impact analysis (DPIA) on the Chrome browser and the system running on the Chromebooks. At this time there is no definite word on this. Information on this will follow later.
Support from SURF
To help you make the necessary adjustments, we offer the following support: An information package will be available to the board of institutions no later than the first week of August to help you make the changes.
