Privacy consequences for Google's products in schools must be assessed

KS (Norwegian Association of Local and Regional Authorities) and Bergen municipality are launching a project to carry out and test a national assessment of privacy consequences (DPIA) for Google's products and services in schools. The aim is to gather experience for governance and coordination of such processes.

KS and Bergen municipality are launching a project to carry out and test a national data protection impact assessment of Google’s products and services in schools. 

The technological development in the education sector, and the use of digital services in teaching, has increased considerably in recent years. Data about students is collected and processed in several digital services, both administrative and educational. Microsoft, Apple and Google are the major platform suppliers to Norwegian schools.

According to the Norwegian Directorate of Education (GSI, 2021), 21 per cent of pupils in Norwegian schools have their own Google Chromebook. In addition, several schools use Google's services on other digital devices.

Challenging for the municipalities to take care of processing responsibility

Each individual school owner is responsible for the processing of the solutions used in education. This is clearly stated in the Norwegian Personal Data law (Personopplysningsloven) where among other things, each individual school must  carry out a risk and vulnerability analysis (ROS), assess privacy consequences (DPIA), enter into a data processing agreement with suppliers and make assessments related to third country issues (suppliers outside the EU/EEA, scope of the GDPR etc.). All municipalities are subject to the same legal requirements, but have very different capacities and conditions for complying with the regulations, which the Data Protection Commission also points out in NOU 2022:11 (Official Norwegian Government report) from September 2022.

- We know that it is challenging for the municipalities to carry out assessments related to privacy and information security in solutions that are used in Norwegian schools today. It is not efficient for each municipality to make the same assessments for the same solutions. This leads to significant duplication of work in an area where the municipalities already have varying capacities and expertise. We hope that the pilot project for Google can be a pioneering project for how the sector can coordinate these processes to a greater extent in the future, says Asbjørn Finstad, department director for Strategic ICT and digitalisation in KS.

A better starting point for the municipalities

In the past year, cases have been ongoing in both the Netherlands and Denmark related to the use of Google in schools. Based on this, Bergen municipality has started work on a comprehensive update of their DPIA. At the same time, they recognize that it is a formidable task that it is not appropriate for the individual municipality to do on its own.

- Bergen municipality therefore proposed that KS contribute to the realization of an overarching national DPIA for Google's services for the municipalities in Norway. An overarching national DPIA will give the municipalities a better starting point for negotiations with Google as a supplier, and the individual municipality will also have a good basis for making their individual DPIAs linked to their specific use of Google products and services, says Are Andreassen, section manager digitization and business management, city council department for kindergartens, schools and sports in Bergen municipality.

Applicability and relevance for other solutions and subject areas

- The project is now in the planning phase, and will scale up its activities throughout the spring. The aim is to have an overarching national DPIA in place by the end of the year. In addition to the overall national DPIA, an accompanying guide will be prepared for how the municipalities can adopt the overall national DPIA in order to adapt and anchor the DPIA to the individual municipality. The project will also document and evaluate the process, as the experiences will have applicability and relevance for national assessments of other similar solutions and services, for example Microsoft 365. The experiences will also be relevant for similar processes on other solutions and services in use in schools and upbringing, but also on other subject areas such as universal design, says Asbjørn Finstad.

Translation by Rebecca Røilid Knudsen