Tietosuojavaltuutetun toimisto (Finland) - TSV/40/2018
Finland's DPA orders city to limit pupil data processing via Google tools.
Finland's Data Protection Ombudsman (DPA) has ordered the city of Espoo to ensure that personal data of pupils collected through Google's digital learning tools is processed solely for educational obligations. The ruling stems from a complaint that the city was using Google applications without parental consent, invoking Article 6(1)(c) GDPR as the legal basis. The DPA clarified that while this legal basis can apply to essential teaching tools, data cannot be disclosed to third parties for their own purposes, such as service development.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe city of Espoo deployed Google's digital learning tools for pupils without obtaining proper parental consent and without ensuring data was restricted to educational purposes, violating GDPR Article 6(1)(c). The core failure was treating a legitimate legal basis (legal obligation for teaching) as a blanket justification for broader data sharing, including with Google for its own service development. This matters because schools process highly sensitive data belonging to minors, a protected category requiring heightened scrutiny. Misidentifying or over-extending a legal basis exposes public institutions to enforcement action and erodes trust with parents and students. Third-party EdTech vendors must never be permitted to repurpose student data for their own commercial ends.
What helps against this
How we list vendors- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.