- It is summer news, which appeared in several places, in which the Basque Data Protection Authority (AVPD) opened a file to the Basque Government’s Department of Education for violating the data protection of students by forcing them to use some Google products. We've been waiting to see what the AVPD published on its website, but it looks like they've been froze the informative. Well, we'll bring you what other sources say.
In the 2022 BOPV newsletter it can be found that the Basque Government signed an agreement with Google Cloud Emea Limited to use the services of the Google Workspace for Education platform in the educational centers of the Department of Education. Apparently, according to this website, the agreement had the approval of the AVPD since last September, but a complaint was filed in 2023, and since then this dossier.
This Google platform, which supposedly allows the storage of student data on servers in the United States, is the point that breaks the data protection against the GDPR criteria. This is not the only error of the agreement, according to the same article, the AVPD has underlined the following:
- deficiencies in the transparency of data processing.
- An impact assessment (EIPD) is said to have to be carried out, and despite having consulted the AVPD, the full EIPD was not requested.
- Incomplete, insufficient risk assessment.
- The opinion of the interested parties was not consulted and is therefore considered essential for the correct risk assessment.
- Errors in documentation.
More information on the web Personal Data of Guipuzkoan lawyer Jorge Campanillas.
Image:Corporate image of Google Workspace for Education.