Data Protection Impact Assessment (DPIA) of Google Workspace for Education

Warning: This is a summary article. It means that some nuances might be "lost" in simplification. You should be cautious about drawing conclusions from what is written here.

Note that what we have assessed in the Google DPIA are the services YouTube and Google Search and Assistant. These are additional services in Google Workspace for Education. Although they share names with the consumer internet services YouTube and Google Search that you can use as a consumer, they are not the same services.

School owners can use the core services in Google Workspace for Education, not the additional services

The main conclusion of the DPIA is that Norwegian school owners can use the core services of Google Workspace for Education and still meet their privacy obligations, but not the additional services.

We also conclude that school owners can use the Chrome services, Chrome browser, and Chrome OS, as long as they are used on a managed Chromebook and what is called Data Processor Mode is turned on. Already, you can tell this is complex. There are many details that will "go over your head" unless you delve a bit deeper into the matter.

But in short: Core services yay! Additional services nay!

Why is that? It's really too complex to get into here. Read Attachment 1 in the DPIA if you want a closer explanation. For now, it's sufficient to say that this conclusion revolves around Google being the data controller for the additional services, which means Google will process student data for purposes beyond those outlined by the Education Act.

As a school owner, you cannot process student data for purposes other than those specified by the Education Act. Using the additional services would violate privacy regulations and the framework you must adhere to under the Education Act.

If you read the previous paragraph and thought, "What! They're saying that YouTube and Google Search as I know them from the internet are forbidden! Oh no!", that's NOT what we're saying. Even though YouTube and Google Search and Assistant are additional services that share names with what you are used to on the internet, they are different services inside and outside Google Workspace for Education. Please continue reading this entire article. Hopefully, this will become clearer as you go.

What are the core services and what are the additional services?

Core services are services where Google processes information about students following instructions from you as the school owner.

Additional services are services where Google is the data controller. Currently, it is not feasible for you as a school owner to use the additional services while still complying with your privacy obligations and processing student data within the framework of the Education Act.

In the illustration below, we have marked the examples YouTube and Google Search and Assistant in a red frame. These are just examples of additional services that are problematic to use.

It's important to remember that the additional services YouTube and Google Search and Assistant as they exist as services in Google Workspace for Education, are set up differently than how we consumers are used to using them on private devices.