Tietosuojavaltuutetun toimisto (Finland) - TSV/40/2018
Finland's DPA orders city to limit pupil data processing via Google learning tools.
Finland's Data Protection Authority (DPA) has ordered the city of Espoo to ensure that pupil personal data collected through Google's digital learning tools is processed solely for educational obligations. The DPA found that while Article 6(1)(c) of GDPR could be a legal basis for using essential teaching tools, the city had not adequately limited data processing for its own purposes. This decision stems from a 2018 complaint regarding the use of tools like Google Classroom and Drive without parental consent.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe city of Espoo failed to adequately define and limit the legal basis for processing children's personal data when deploying third-party educational tools like Google Classroom and Drive. While GDPR Article 6(1)(c) may justify essential teaching functions, the city did not ensure that Google was prohibited from using pupil data for its own commercial purposes, creating a compliance gap. This matters because children represent a particularly vulnerable data subject category, and schools acting as data controllers bear responsibility for how processors handle that data. Failing to conduct proper Data Protection Impact Assessments (DPIAs) and vendor due diligence before deployment exposes institutions to regulatory sanctions and erodes public trust.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.