The Danish Data Protection Authority (Datatilsynet) has reported progress in municipalities’ compliance with the January 2024 ruling on Google Workspace usage in schools, that I wrote about here. KL (Local Government Denmark), representing 52 municipalities, confirmed that, effective 1 August 2024, personal data will no longer be shared with Google for purposes previously deemed unlawful by Datatilsynet.
Contract Adjustments and Data Processing
KL communicated that contract modifications ensure personal data processing adheres strictly to municipal instructions, except where EU law requires otherwise. These adjustments address the issue of children’s data being shared without a legal basis.
Ongoing Issues and Future Steps
Despite addressing the main issue, Datatilsynet noted ongoing concerns. The January ruling emphasized the need for clear contract terms and continuous monitoring of data processing activities. Municipalities have pledged to avoid services processing personal data in non-EU countries without equivalent data protection.
Subprocessor Documentation
Datatilsynet has requested an opinion from the European Data Protection Board regarding the obligations of data controllers to document subprocessor use. Once this opinion is available, Datatilsynet expects to make a final assessment of the subprocessing chain in municipalities’ use of Google’s products.
See press release here.
♻️ Share this if you found it useful.
💥 Follow me on Linkedin for updates and discussions on privacy, digital and AI education.
📍 Subscribe to my newsletter for weekly updates and insights – subscribers get an integrated view of the week and more information than on the blog.
