AP opinion: Google Workspace in education has too many risks
The Personal Data Authority (AP) says it is unclear whether personal data in Google Workspace (formerly Google Suite for Education) is adequately protected.
Educational organizations are urgently appealing to Google's corporate social responsibility to properly safeguard the privacy of pupils and students and immediately initiate the removal of the risks
Conclusions confirm results DPIA
In early March 2021, SURF and SIVON, also on behalf of PO/VO/MBO council, Kennisnet, the VH and VSNU, asked the AP for advice on Google Workspace, after concerns were insufficiently addressed in the discussions they had had with Google up to that point. The AP's conclusions confirm that there are currently too many privacy risks associated with the use of Google Workspace. Those risks came to light during research commissioned by the University of Groningen (RUG) and the Hogeschool van Amsterdam (HvA) and the DPIA of the Strategic Supplier Management Rijksoverheid (SLM Rijk).
Risks when using Google Workspace
The risks are in Google's collection of so-called metadata. In doing so, Google sees itself as a data controller rather than a processor. This means that Google believes it may determine the purpose for which it collects data and the manner in which it does so. Google has also included in its privacy agreements that it may unilaterally modify the conditions surrounding metadata, without asking the user for permission again. According to the AP, it should always be clear what data is involved. If not, this violates the AVG. Under the current circumstances, educational institutions may no longer use Google Workspace starting next school year, the AP reports.
In conversation with Google
In a letter to the House of Representatives today, the Ministry of Education, Culture and Science indicated that it assumes Google will have resolved the identified issues before the start of the 2021/2022 school year. SIVON and SURF, together with SLM Rijk, are currently speaking with Google to quickly clarify how Google will make the necessary adjustments as soon as possible.
Social responsibility Google
e make an urgent appeal to Google's social responsibility to properly safeguard the privacy of pupils and students and promptly initiate the elimination of risks. Especially in the case of (young) children, this responsibility is especially great, because at this age children are (or may be) insufficiently aware of privacy risks.
Impact on educational institutions
Google, in a response to the advisory, has indicated that they are committed to the AVG and said they will resolve the deficiencies. Until then, we recommend that educational institutions considering starting with Google Workspace discontinue those plans until further notice, and educational institutions that have a good alternative available use it. Want to know what you yourself can do in the short term to improve the security of using Google Workspace? Then read this article on kennisnet.nl.
