Denmark bans Chromebooks and Google Workspace in schools over data transfer risks

Published by
Peter Kavinsky

Denmark is effectively banning Google’s services in schools, after officials in the municipality of Helsingør were last year ordered to carry out a risk assessment around the processing of personal data by Google.

In a verdict published last week, Denmark’s data protection agency, Datatilsynet, revealed that data processing involving students using Google’s cloud-based Workspace software suite — which includes Gmail, Google Docs, Calendar, and Google Drive — “does not meet the requirements” of the European Union’s GDPR data privacy regulations.

Specifically, the authority found that the data processor agreement — or Google’s terms and conditions —  seemingly allow for data to be transferred to other countries for the purpose of providing support, even though the data is ordinarily stored in one of Google’s EU datacenters.

Google’s Chromebook laptops, and by extension Google Workspace, are used in schools across Denmark. But Datatilsynet focused specifically on Helsingør for the risk assessment after the municipality reported a “breach of personal data security” back in 2020. While this latest ruling technically only applies to schools in Helsingør for now, Datatilsynet notes that many of the conclusions it has reached will “probably apply to other municipalities” that use Google Chromebooks and Workspace. It added that it expects these other municipalities “to take relevant steps” off the back of the decision it reached in Helsingør.

The ban is effective immediately, but Helsingør has until August 3 to delete user data.

Data flows

At the heart of the issue is the now defunct EU-US Privacy Shield that regulated how data can be shared between the EU and United States. While a new data flow deal has been agreed in principle, it is not yet in effect which has left many organizations in limbo. Consequently, big tech companies are relying on standard contractual clauses for their data processing practices.

A Google spokesperson told TechCrunch:

We know that students and schools expect the technology they use to be legally compliant, responsible, and safe. That’s why for years, Google has invested in privacy best practices and diligent risk assessments, and made our documentation widely available so anyone can see how we help organisations to comply with the GDPR.

Schools own their own data. We only process their data in accordance with our contracts with them. In Workspace for Education, students’ data is never used for advertising or other commercial purposes. Independent organisations have audited our services, and we keep our practices under constant review to maintain the highest possible standards of safety and compliance.

This latest announcement comes after local data watchdogs in France, Italy, and Austria ruled that websites using Google Analytics to track visitors contravened European data privacy rules, given that personal data is transferred to the U.S. for processing. And Ireland’s Data Protection Commission (DPC), meanwhile, is currently mulling how Facebook’s parent company Meta is transferring data between Europe and the U.S., which could impact how Europeans are able to access services such as WhatsApp and Instagram.

With European lawmakers keen to establish a greater degree of digital sovereignty, Google has been bolstering its platform and infrastructure to help ensure public and private organizations stay with the company. A few months back, Google announced that it would be rolling out new “sovereign controls” for Workspace users in Europe, allowing them to “control, limit, and monitor transfers of data to and from the EU.”

However, these controls won’t be made available until later this year, with additional data control tools arriving throughout 2023. And it’s still not clear at this early stage whether these new tools will be watertight in terms of GDPR compliance.

Source: TechCrunch

Peter Kavinsky

Peter Kavinsky is the Executive Editor at

Published by
Peter Kavinsky

Recent Posts

  • News

[HQ] Lenape vs Rancocas Valley Live Football 17th August 2022

Click Here to Watch this High School Football Live Online for Free! How To Watch…

3 mins ago
  • News

Karel Oliva’s last word: Dieppe 1942 | nzory

<!----> jet v17. In the century, Dieppe was the most important city in France, but…

4 mins ago
  • News

Venue raises $4M from Accel and CEOs of Slack, Remote and SquareSpace to breathe new life into team hangouts – CableFree TV

Zoom has won the opinion game in many ways when it comes to videoconferencing: whether…

5 mins ago
  • News

Inflation Reduction Act Adds Dynamic Glass to Investment Tax Credit and Other News

The passage of this law will have a transformative effect on the electrochromic glass industry.…

6 mins ago
  • News

The Russian ferry “Lavrentiy” arrived at the port of Mariupol

The Russian ferry "Lavrenty" arrived in Mariupol - with the identification systems turned off. This…

8 mins ago
  • News

Territorial order plan: Claudia Lopez a Peñalosa and Uribismo: “They don’t do it and they don’t allow it” | Bogota

at the meetingo Bogotá Chamber of Commerce Presidents Forummayor Claudia Lopez, In addition to thanking…

11 mins ago