Status of Google Workspace DPIA: update on privacy measures

Institutions will be notified as soon as possible after delivery. They will then also hear whether they may need to make any adjustments themselves. Based on the agreements with Google, SIVON and SURF conclude that they do not need to discourage the use of Google Workspace.

Google picks up remaining points

In January, SIVON, SURF and a team of external (privacy) experts and lawyers thoroughly examined and assessed the above measures. We shared the results of our analysis with Google last February. Following this, intensive discussions took place on a number of key issues that have not yet been resolved. Google confirmed in March that they are still resolving these remaining points. SIVON and SURF - in coordination with OCW - have decided that Google will have until mid-June to do so.

What does this mean for institutions?

The board of an institution is ultimately responsible for the safe use of educational and digital applications; it decides which applications their institution uses and under what conditions. In light of the agreements made with Google, SIVON and SURF do not advise against the use of Google Workspace. Institutions will receive a full analysis of all measures as soon as possible after the mid-June delivery date, explaining any actions the board itself can take. The education partners of OCW, SIVON and SURF will - now and in the future - remain in close contact with Google to monitor whether Google removes any risks. SIVON and SURF institutions will be informed as soon as there is more news.

Continuous monitoring legality of great importance

SIVON and SURF subscribe to the importance of privacy and strive to embed privacy agreements in contracts with suppliers. We therefore attach great importance to continuously evaluating (cloud) services and assessing their legitimacy. We keep an eye on changing laws and regulations, periodically review existing contracts against these and adjust them where necessary. In addition, we are in constant dialogue and negotiation with suppliers to ensure that services can be used safely and responsibly.

Informing the Personal Data Authority

On 7 March 2023, the Personal Data Authority (AP) wrote to OCW asking it to remain alert to ensuring privacy when using Google applications. The AP asked OCW to inform it of the state of play by 15 May. Following this letter, OCW has been in contact with the AP. In it, she explained the agreements made between SIVON, SURF and Google and explained that institutions will receive clarity on Workspace for Education by mid-June at the latest.

Finally: state of play on Google Chromebooks, ChromeOS and Chrome browser

It is worth noting that the above DPIA on Google Workspace is separate from the DPIA conducted on Chromebooks, ChromeOS and Chrome browser. During this separate process, SIVON and SURF reached agreements with Google on a new version of ChromeOS. This updated version will be ready around August this year. Institutions will be informed about this separately.

More information

View the full list of news items.