Student Personal Data Exposed via School-Mandated Online Profiles
In 2019, a public school in Denmark required students to use school-provided laptops and set up public profiles on a video-sharing platform. This resulted in the public exposure of a student’s personal details, including their full name, age, school name, and class, without parental consent.
Student Data Exposed via School-Issued Account
A parent discovered that their child’s personal data was made public through a student account configured on a technology company’s hardware and software platform. In response, the parent initiated a campaign that ultimately resulted in a national data protection authority issuing an injunction against schools using the platform to collect and process student personal data.
Child targeted through publicly identifiable YouTube account
A child became fearful of digital harassment after misuse of a publicly identifiable YouTube account. This is a personal interview. Source available to SHIELD.
Children issued Chromebook credentials on visible stickers
Children received devices with visible login credentials attached via stickers. This is a personal interview. Source available to SHIELD.
Australian mother relied on school-recommended educational technologies without information about privacy risks
A mother reported participating in remote education based on trust that schools had evaluated privacy implications without having been asked in advance for consent or informed how her children’s rights might be protected or affected. The consequence was uninformed adoption of potentially privacy-invasive systems.
Unlawful Data Processing of Public School Students via Google Chromebooks and Workspace in Danish Municipalities
Students in public schools across several Danish municipalities had their personal data unlawfully transmitted to Google. The municipalities deployed Google Chromebooks and Workspace for Education for schoolwork, which resulted in the continuous collection and transfer of students’ personal data to Google for its own purposes, such as product improvement and performance measurement. The Danish Data […]
Danish Data Protection Authority Rules Against Municipality Over Chromebook Data Security Violations
A Danish municipality deployed Google Chromebooks and G Suite for Education in its municipal schools without conducting required risk assessments or ensuring proper privacy configurations. Consequently, the personal data of pupils was processed in violation of the GDPR, exposing them to risks of unauthorized data profiling and sharing. The Danish Data Protection Authority issued a […]
Danish Data Protection Authority Upholds Ban on Google Workspace and Chromebooks in Danish Municipal Schools
The Danish Data Protection Authority (Datatilsynet) upheld a ban prohibiting a municipality in Denmark from processing pupil and teacher personal data using Google Workspace and Chromebooks due to high privacy risks. The regulator determined that the municipality had failed to adequately analyze and mitigate data transfer and security risks, particularly concerning potential unauthorized data processing […]
Data Exposure of School Students via Chromebooks and G Suite in Denmark
Public school students in a municipality in Denmark had their personal information, including full names, schools, and grades, publicly exposed on YouTube and Gmail due to the municipality’s misconfiguration of school-issued Chromebooks and G Suite for Education accounts. In several cases, the real names of students with legally protected identities were exposed instead of anonymous […]