Google is developing another version of its operating system for Chromebooks. This version addresses the privacy concerns of the education community. From now on, Google may only use the data it collects through ChromeOS to maintain its services, address threats and develop updates. Privacy Company laid out the details of the agreements in a weblog.
Discussions about possible privacy violations by Google Workspace have been ongoing for some time. In March, outgoing Minister of Education, Culture and Science Ingrid van Engelshoven and Minister of Elementary and Secondary Education and Media Arie Slob wrote in a letter to the House of Representatives that there were privacy risks associated with Google Workspace. Schools had "no or insufficient control" over the processing of metadata, a Data Protection Impact Assessment (DPIA) revealed.
The administration decided to ask the Autoriteit Persoonsgegevens how Google Workspace could be used without privacy risks to pupils, students and teachers. The regulator published in June with two critical reports that answered this pressing question. It was concerned about Google's email and cloud services. Educational institutions do not know how and where personal data about students is processed, for what purpose and on what basis it is processed.
The Autoriteit Persoonsgegevens advised educational institutions to stop using Google Workspace for the time being. The regulator concluded that there are "fundamental questions" about privacy protection and processing of personal data that must first be answered. Only then can it issue a ruling on Google's compliance with the General Data Protection Regulation (AVG).
Several agencies in the education community indicated that they would not cast aside Google Workspace for the time being. However, they were considering no longer using Google's services if the search engine giant did not address concerns about privacy risks in the near future.
After weeks of intensive discussions, the education umbrella organizations SURF and SIVON announced that agreements had been reached with Google that "sufficiently implement the protection of personal data in accordance with the AVG. In their own words, agreement had been reached on "a comprehensive set of contractual, organizational and technical measures. This addressed all high privacy risks.
Details of the agreements between the education authorities and Google had not yet been disclosed. Privacy Company did so Tuesday in an extensive weblog. The main change is that Google will no longer act as data controller, but will act as data processor.
This is a big change because it puts limits on what all Google can do with the metadata it collects. Under the old terms, the search giant used this information for commercial purposes, including showing ads. Because Google now acts as a data processor, it may only use metadata to maintain its services, address threats and develop updates.
To meet these commitments, Google is currently developing a so-called processor version of its ChromeOS operating system and Chrome web browser. Privacy Company states that this is "an important commitment" because many (elementary) schools in the Netherlands use Chromebooks. When this alternative version will be ready is unknown. Until then, educational institutions will have to take their own measures to use Chrome in a safe and responsible manner.
What won't change for now is that Google remains data controller for services it calls "Additional Services. These include things like YouTube, Search, Photos and Maps. Children who use Google's search feature are automatically logged out of their Google Workspace for Education account. This way, searches cannot be linked to them. Google cannot then use this data for personalized ads, according to Privacy Company.
Finally, Google has pledged to become more transparent. The Internet company is going to publish "significantly more" documentation on the types of personal data it collects about individual use of its services. Furthermore, there will be a data inspection tool for system administrators. With it, they will see at a glance what data Google collects.
