Tietosuojavaltuutetun toimisto (Finland) - TSV/40/2018

Summary

Finland's Data Protection Authority (DPA) has ordered the city of Espoo to ensure that pupil personal data collected through Google's digital learning tools is processed solely for educational obligations. The DPA found that while Article 6(1)(c) of GDPR could be a legal basis for using essential teaching tools, the city had not adequately limited data processing for its own purposes. This decision stems from a 2018 complaint regarding the use of tools like Google Classroom and Drive without parental consent.

Full text

Help Tietosuojavaltuutetun toimisto (Finland) - TSV/40/2018: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 11:56, 28 September 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators192 edits Tag: Decisions [1.0] Latest revision as of 12:01, 28 September 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators192 edits Tag: Visual edit (One intermediate revision by the same user not shown)Line 95: Line 95: In April 2018, the DPA received a complaint stating that the city of Espoo (the controller) was using Google's digital learning tools in a school without obtaining consent from pupils’ (the data subjects’) parents.In April 2018, the DPA received a complaint stating that the city of Espoo (the controller) was using Google's digital learning tools in a school without obtaining consent from pupils’ (the data subjects’) parents. The controller clarified that it used a number of Google applications for educational purposes, including Google Classroom, Google Drive, and Google Docs. It invoked [[Article 6 GDPR|Article 6(1)(c) GDPR]] as the legal basis for the processing. According to the controller, the processing of personal data in connection with using these services was necessary to comply with the obligation to provide basic education laid down in the Finnish Basic Education Act.The controller clarified that it used a number of Google applications for educational purposes, including Google Classroom, Google Drive, and Google Docs. It invoked [[Article 6 GDPR|Article 6(1)(c) GDPR]] as the legal basis for the processing. According to the controller, the processing of personal data in connection with using these services was necessary to comply with the obligation to provide basic education laid down in the [https://www.finlex.fi/fi/lainsaadanto/1998/628 Finnish Basic Education Act]. The DPA issued a decision in case 1509/452/18 in December 2021. This decision was appealed to the Supreme Administrative Court, which referred the case back to the DPA in its decision [[KHO - KHO:2025:29|KHO:2025:29]] in April 2025. The Supreme Administrative Court held that the DPA could not conclude [[Article 6 GDPR|Article 6(1)(c) GDPR]] was not applicable in any respect as a legal basis for the processing. The DPA issued a decision in case 1509/452/18 in December 2021. This decision was appealed to the Supreme Administrative Court, which referred the case back to the DPA in its decision KHO:2025:29 in April 2025. The Supreme Administrative Court held that the DPA could not conclude [[Article 6 GDPR|Article 6(1)(c) GDPR]] was not applicable in any respect as a legal basis for the processing. In the present proceedings, the DPA was to decide the extent to which the controller could invoke the compliance with a legal obligation as a legal basis for the processing of personal data related to the use of Google’s digital learning tools.In the present proceedings, the DPA was to decide the extent to which the controller could invoke the compliance with a legal obligation as a legal basis for the processing of personal data related to the use of Google’s digital learning tools. === Holding ====== Holding === The DPA ordered the controller to ensure that the personal data of pupils collected in connection with the use of Google's digital learning tools was solely processed for the purpose of fulfilling the controller's educational obligations. The processing could be based on Article 6(1)(c) only under these conditions. The DPA ordered the controller to ensure that the personal data of pupils collected in connection with the use of Google's digital learning tools was solely processed for the purpose of fulfilling the controller's educational obligations. The processing could be based on [[Article 6 GDPR|Article 6(1)(c) GDPR]] only under these conditions. The DPA held that the controller could invoke Article 6(1)(c) as a legal basis for the use of learning tools essential to teaching. In addition, the processing must be carried out solely to fulfill educational obligations. The DPA pointed out that this legal basis applies to the use of tools that are central to teaching, such as text editors, calendars, email, presentation software, and programs intended for subject-specific instruction (such as language or math applications).The DPA held that the controller could invoke [[Article 6 GDPR|Article 6(1)(c) GDPR]] as a legal basis for the use of learning tools essential to teaching. In addition, the processing must be carried out solely to fulfill educational obligations. The DPA pointed out that this legal basis applies to the use of tools that are central to teaching, such as text editors, calendars, email, presentation software, and programs intended for subject-specific instruction (such as language or math applications). When assessing the necessity requirement, the DPA took into account that digital learning tools can enable the extensive and long-term collection and other processing of school-aged children’s personal data by and for the benefit of external entities. Therefore, it held that the controller may not disclose or otherwise grant access to this data to the controller or other parties in a way that allows the controller to process the data for its own purposes, such as developing the learning tools or other services.When assessing the necessity requirement, the DPA took into account that digital learning tools can enable the extensive and long-term collection and other processing of school-aged children’s personal data by and for the benefit of external entities. Therefore, it held that the controller may not disclose or otherwise grant access to this data to the controller or other parties in a way that allows the controller to process the data for its own purposes, such as developing the learning tools or other services. Latest revision as of 12:01, 28 September 2026 Tietosuojavaltuutetun toimisto - TSV/40/2018 Authority: Tietosuojavaltuutetun toimisto (Finland) Jurisdiction: Finland Relevant Law: Article 6(1)(c) GDPR Type: Other Outcome: n/a Started: Decided: 04.09.2026 Published: 04.09.2026 Fine: n/a Parties: Espoon kaupunki Google National Case Number/Name: TSV/40/2018 European Case Law Identifier: n/a Appeal: Unknown Original Language(s): Finnish Original Source: Finlex (in FI) Initial Contributor: av The DPA ordered a city to ensure that the personal data of pupils collected when using digital learning tools was only processed to fulfill the controller’s educational obligations. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts In April 2018, the DPA received a complaint stating that the city of Espoo (the controller) was using Google's digital learning tools in a school without obtaining consent from pupils’ (the data subjects’) parents. The controller clarified that it used a number of Google applications for educational purposes, including Google Classroom, Google Drive, and Google Docs. It invoked Article 6(1)(c) GDPR as the legal basis for the processing. According to the controller, the processing of personal data in connection with using these services was necessary to comply with the obligation to provide basic education laid down in the Finnish Basic Education Act. The DPA issued a decision in case 1509/452/18 in December 2021. This decision was appealed to the Supreme Administrative Court, which referred the case back to the DPA in its decision KHO:2025:29 in April 2025. The Supreme Administrative Court held that the DPA could not conclude Article 6(1)(c) GDPR was not applicable in any respect as a legal basis for the processing. In the present proceedings, the DPA was to decide the extent to which the controller could invoke the compliance with a legal obligation as a legal basis for the p

Entities