The report, published six months ago, was the subject of an article in El Mundo on December 27 and taken up by Le Figaro on January 3. It follows a request from the Spanish Ministry of Education, more precisely from the National Institute of Educational Technologies and Teacher Training (Intef), which is part of it.
The request was based on an observation: since the 2020 lockdown, many schools have switched to integrated solutions to facilitate remote work and communication. The question was whether these services, of which Google appears to be the majority, were in line with Spanish law and the General Data Protection Regulation (GDPR).
Dangers for students
The report, 64 pages long, is not public. Consulted by El Mundo, he describes various dangers for students. “ It is undeniable that we are in the presence of an invasive collection of personal information », indicates the AEPD. The data, which mainly comes from minors, is “ of a particularly sensitive nature ».
Comments were made on many services. We find the Docs word processor, the Sheets spreadsheet, Calendar, Gmail, the Meet videoconferencing service and the Drive online storage space. Services “ additional » are also cited, including YouTube for videos, Maps for maps and GPS, as well as Photos for storing and synchronizing images.
Or, « from interactions with the different services, data on health or religious beliefs could be deduced. And this information could be transferred to third countries which would not guarantee a sufficient level of protection “. The report recalls that the conditions of use very clearly mention the possibility of data being stored in servers located anywhere in the world.
Observations already made by Intef, as indicated to Le Figaro by its director, Julio Albalad, who also points out the possibility for Google to unilaterally modify its conditions. “ But the agency goes much further when it comes to YouTube and Maps, through which the company can indulge in its specialty, data profiling “, he added.
For Google, everything is perfectly in order
Google claims for its part that everything is in order: “ The company does not use the personal data that students share in Workspace; and with regard to additional services, there is no sharing of data for advertising purposes or creation of profiles “, declared a spokesperson to Le Figaro.
The company recalls that it has all the required ISO standards, as well as certifications from the Spanish National Cryptology Center and compliance with the National Security Scheme, imposed on Spanish administrations.
Spain: a special situation
Even if the report was submitted by the AEPD to the Ministry of Education, the latter only has limited “powers” in absolute terms. Spain is in fact neither a centralized state nor a federation. In this constitutional monarchy with a particular configuration, unique in Europe, each region has a great deal of autonomy. In the wake of the health crisis, everyone has made their own choices of educational tools. Only the schools in Ceuta and Melilla are under direct administration of the ministry.
As El Mundo notes, the results of the survey were shared with all regions. Madrid, Andalusia, Extremadura, Canary Islands, Murcia and La Rioja currently use Google Workspace for Education and have no plans to change at this time. Andalusia and the Canary Islands have just renewed their contract with Google for a period of four years.
According to El Mundo’s sources, Google’s tools are the subject of particular attention in the Canaries, particularly on security, with several audits already carried out. The media adds that the students’ accounts were subject to restrictions: “ they cannot chat, use YouTube, install Google Play apps, create video calls via Meet and can only send and receive Gmail emails with other students and teachers in the Canary Islands ».
Not Google, but Microsoft
Murcia also declared that it would keep the Google solution, adopted already fifteen years ago, because it is a “ service widely used and requested by the educational community “. At the same time, the region has banned screens until fifth grade.
On the other hand, the region of Castile and León does not want to turn to Google, because its tools “ escape the security control of the administration “. She preferred to turn to Microsoft. We do not know, at present, whether the AEPD also intends to look into the company’s 365 offer.
In France, the open bar contract between Microsoft and National Education had been the subject of strong criticism and several complaints. It is still in progress, even if the free versions of Office 365 and Google Workspace are no longer allowed to be installed since the end of 2022. The previous year, the CNIL had called “ to developments in the use of American collaborative tools for higher education and research “. In Europe, the question of the adequacy of protections for personal data with the United States remains at the heart of lively debates, particularly in the context of the future EUCS directive as well as in the storage of health data.
