Denmark bans Google Products: Following a risk assessment of personal data processing by primary schools in a municipality in North Eastern Denmark, Denmark’s DPA (DSK) has banned the use of Google’s Workspace productivity package in public sector organizations as of 3 August 2022.
Background
This risk assessment comes after France, Italy, and Austria DPAs concluded that websites using Google Analytics to track visitors violated European data privacy standards since personal data is transmitted to the U.S. for processing.
Data processing involving students using Google’s cloud-based Workspace software, which includes Gmail, Google Docs, Calendar, and Google Drive, which “does not meet the (EU data privacy) requirements,” according to a decision issued last week by Denmark’s data protection authority, Datatilsynet.
In particular, the authority discovered that even though the data is often kept in one of Google’s EU data centers, Google’s terms and conditions appear to permit data to be moved to other countries for the purpose of providing support.
Denmark Bans Google Products: Risk Assessment
Danish schools use Google’s Chromebook laptops and also Google Workspace. However, the city of Helsingr was the sole subject of Datatilsynet’s risk assessment because the municipality had already reported a “breach of personal data security” in 2020.
Datatilsynet states that many of its findings will “probably apply to other municipalities” that employ Google Chromebooks and Workspace, even though this most recent decision currently only formally pertains to schools in Helsingr. It further stated that in light of the judgment it obtained in Helsingr, it anticipates these other municipalities “to take suitable steps.”
Helsingr has until August 3 to remove user data before the ban takes effect.
Google’s Response
In order to ensure that public and private organizations stick with the corporation, Google has been strengthening its platform and infrastructure in response to European politicians’ desire to achieve a higher level of digital sovereignty. A few months ago, Google revealed that Workspace users in Europe would soon have access to new “sovereign controls” that would let them “manage, limit, and monitor transfers of data to and from the EU.”
These controls won’t be accessible until later this year, and more data control capabilities won’t be available until 2023. Furthermore, it is also unclear at this early stage if the new tools will be completely GDPR compliant.
This piece is part of an ongoing series about the latest decisions on Google Analytics. Want to know more? See our other related guides here:
- Is Google Analytics illegal in the EU and UK?
- Google Analytics 4 all you need to know
- CNIL’s latest on Google Analytics