Students in public schools across several Danish municipalities had their personal data unlawfully transmitted to Google. The municipalities deployed Google Chromebooks and Workspace for Education for schoolwork, which resulted in the continuous collection and transfer of students’ personal data to Google for its own purposes, such as product improvement and performance measurement. The Danish Data Protection Authority (Datatilsynet) ruled that there was no legal basis for these transfers under Danish education law or the GDPR, issuing orders to the municipalities to bring the processing into compliance.