Student Data Exposed via School-Issued Account
A parent discovered that their child’s personal data was made public through a student account configured on a technology company’s hardware and software platform. In response, the parent initiated a campaign that ultimately resulted in a national data protection authority issuing an injunction against schools using the platform to collect and process student personal data.
Unlawful Data Processing of Public School Students via Google Chromebooks and Workspace in Danish Municipalities
Students in public schools across several Danish municipalities had their personal data unlawfully transmitted to Google. The municipalities deployed Google Chromebooks and Workspace for Education for schoolwork, which resulted in the continuous collection and transfer of students’ personal data to Google for its own purposes, such as product improvement and performance measurement. The Danish Data […]
Danish Data Protection Authority Rules Against Municipality Over Chromebook Data Security Violations
A Danish municipality deployed Google Chromebooks and G Suite for Education in its municipal schools without conducting required risk assessments or ensuring proper privacy configurations. Consequently, the personal data of pupils was processed in violation of the GDPR, exposing them to risks of unauthorized data profiling and sharing. The Danish Data Protection Authority issued a […]
Danish Data Protection Authority Upholds Ban on Google Workspace and Chromebooks in Danish Municipal Schools
The Danish Data Protection Authority (Datatilsynet) upheld a ban prohibiting a municipality in Denmark from processing pupil and teacher personal data using Google Workspace and Chromebooks due to high privacy risks. The regulator determined that the municipality had failed to adequately analyze and mitigate data transfer and security risks, particularly concerning potential unauthorized data processing […]