In July, SURF and SIVON reached an agreement with Google that removes the high privacy risks in Google Workspace for Education. To continue using Workspace for Education, you still need to take some actions yourself. You can read more about them in this article.
If you want to continue using Google Workspace for Education, you must perform 3 actions. You must:
enter the correct (technical) settings
accept the new Google terms and conditions
Conduct an education-specific DPIA
In addition, it is important that you take note of the contents of the Update DPIA report on Google Workspace for Education.. This explains how to mitigate the high privacy risks identified early this year. That document is needed when performing the 3 steps.
Google Workspace's default settings do not provide the highest level of personal data protection. In addition to the new agreement, a number of settings need to be changed in the Google Workspace Admin console to fully comply with the AVG. Kennisnet, SIVON and SURF have developed a manual describing these measures. These measures are also available to ict vendors who can support school boards with adjusting these settings. Take the time to set all the settings properly and communicate them appropriately to your employees.
If you use IT vendors' services for Google Workspace, we recommend engaging with them before making the settings. We recommend checking these settings with some regularity as cloud services such as Google Workspace are constantly evolving. A new release may affect the settings.
Download the Technical Guide for Google Workspace for Education here.
SURF and SIVON have agreed additional legal terms with Google on behalf of the entire education sector to mitigate high privacy risks to users. Around Monday, Aug. 9, 2021, Google will send all known it administrators (system administrators) of Workspace for Education (Plus) an email with information about accepting the new agreement with Google. The email will come from the email address Google-for-EDU-NL[AT]google.com (check your spam box for this).
This amended agreement must be accepted by your educational institution. The competent authority - the school administration or the board of governors - must approve it. In addition, your data protection officer (fg) will also advise on this. With the approval of the competent authority, the new agreement with Google can be accepted. Follow the instructions in the email from Google about accepting the terms.
SIVON and SURF have made good arrangements to eliminate the high risks when using Google Workspace. The overview of measures can be found in the Update on report Google Workspace for Education DPIA. However, the AVG requires each educational institution to make its own risk assessment. This has to do not only with the formal responsibility of the school board, but also with the specific way in which Google Workspace for Education is deployed within your organization and the measures taken in this regard.
In order to support school boards in drawing up an education-specific DPIA, Kennisnet, SIVON and SURF have developed a guide. The purpose of this guide is to support educational institutions in performing their own risk analysis and determining whether there are additional risks in their specific situation.
The guide uses the information contained in the nationally conducted DPIA on Workspace for Education. Educational institutions determine for themselves, based on this, which described processing, risks and measures apply to their own situation. You also add any missing processing operations, risks and measures. Based on this information, the school board ultimately determines which (remaining) risks when using Google Workspace for Education apply to its own specific situation, which measures are needed to eliminate those risks and - finally - whether any high residual risks remain.With this information, the competent authority (school board, executive board) decides on (continuing) the use of Google Workspace for Education (Plus) within the educational institution.
Download the Guide to the education-specific DPIA Google Workspace for Education here.
