Tietosuojavaltuutetun toimisto (Finland) - TSV/40/2018

Summary

Finland's Data Protection Ombudsman (DPA) has ordered the city of Espoo to ensure that personal data of pupils collected through Google's digital learning tools is processed solely for educational obligations. The ruling stems from a complaint that the city was using Google applications without parental consent, invoking Article 6(1)(c) GDPR as the legal basis. The DPA clarified that while this legal basis can apply to essential teaching tools, data cannot be disclosed to third parties for their own purposes, such as service development.

Full text

Help Tietosuojavaltuutetun toimisto (Finland) - TSV/40/2018: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 11:56, 28 September 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators192 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 11:56, 28 September 2026 Tietosuojavaltuutetun toimisto - TSV/40/2018 Authority: Tietosuojavaltuutetun toimisto (Finland) Jurisdiction: Finland Relevant Law: Article 6(1)(c) GDPR Type: Other Outcome: n/a Started: Decided: 04.09.2026 Published: 04.09.2026 Fine: n/a Parties: Espoon kaupunki Google National Case Number/Name: TSV/40/2018 European Case Law Identifier: n/a Appeal: Unknown Original Language(s): Finnish Original Source: Finlex (in FI) Initial Contributor: av The DPA ordered a city to ensure that the personal data of pupils collected when using digital learning tools was only processed to fulfill the controller’s educational obligations. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts In April 2018, the DPA received a complaint stating that the city of Espoo (the controller) was using Google's digital learning tools in a school without obtaining consent from pupils’ (the data subjects’) parents. The controller clarified that it used a number of Google applications for educational purposes, including Google Classroom, Google Drive, and Google Docs. It invoked Article 6(1)(c) GDPR as the legal basis for the processing. According to the controller, the processing of personal data in connection with using these services was necessary to comply with the obligation to provide basic education laid down in the Finnish Basic Education Act. The DPA issued a decision in case 1509/452/18 in December 2021. This decision was appealed to the Supreme Administrative Court, which referred the case back to the DPA in its decision KHO:2025:29 in April 2025. The Supreme Administrative Court held that the DPA could not conclude Article 6(1)(c) GDPR was not applicable in any respect as a legal basis for the processing. In the present proceedings, the DPA was to decide the extent to which the controller could invoke the compliance with a legal obligation as a legal basis for the processing of personal data related to the use of Google’s digital learning tools. Holding The DPA ordered the controller to ensure that the personal data of pupils collected in connection with the use of Google's digital learning tools was solely processed for the purpose of fulfilling the controller's educational obligations. The processing could be based on Article 6(1)(c) only under these conditions. The DPA held that the controller could invoke Article 6(1)(c) as a legal basis for the use of learning tools essential to teaching. In addition, the processing must be carried out solely to fulfill educational obligations. The DPA pointed out that this legal basis applies to the use of tools that are central to teaching, such as text editors, calendars, email, presentation software, and programs intended for subject-specific instruction (such as language or math applications). When assessing the necessity requirement, the DPA took into account that digital learning tools can enable the extensive and long-term collection and other processing of school-aged children’s personal data by and for the benefit of external entities. Therefore, it held that the controller may not disclose or otherwise grant access to this data to the controller or other parties in a way that allows the controller to process the data for its own purposes, such as developing the learning tools or other services. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details. Use of Google’s Educational Program in Schools Keywords Legal basis for processing personal data Year of the case 2026 Date of issuance September 4, 2026 Reference number TSV/40/2018 Legal Basis Decision pursuant to the EU General Data Protection Regulation Decision of the Data Protection Ombudsman Subject Use of Google’s educational software in schools Data Controller Data Controller: City of Espoo The Data Protection Ombudsman issued a decision in case 1509/452/18 on December 30, 2021. In its decision KHO:2025:29 issued on April 8, 2025, the Supreme Administrative Court remanded the matter to the Data Protection Ombudsman for further consideration. Contact from the complainant On April 30, 2018, the complainant contacted the Office of the Data Protection Ombudsman and reported that a school in Espoo uses Google’s educational software in its teaching but does not request parental consent for this. Statement received from the data controller The Office of the Data Protection Ombudsman requested a statement from the data controller via a request for information dated July 1, 2020, as well as via requests for additional information dated September 7, 2020, and November 22,2021. The data controller submitted a written explanation on August 14, 2020, and additional explanations on September 28, 2020, and November 26, 2021. After the Supreme Administrative Court referred the matter back to the Data Protection Ombudsman for consideration, the Office of the Data Protection Ombudsman requested on July 16,2025, the Office of the Data Protection Ombudsman requested a report from the data controller regarding the applications in use at the time of the investigation. The data controller provided a written report on this matter on August 27, 2025, and clarified its responses with a supplementary report at the request of the Office of the Data Protection Ombudsman on October 6, 2025. In its report, the data controller stated that it does not seek parental consent for the use of Google’s educational program; rather, the legal basis for processing is Article 6(1)(c) of the General Data Protection Regulation (compliance with a legal obligation). According to the data controller, the processing of personal data is necessary for the organization of basic education in accordance with the Basic Education Act. However, the Department of Education asks guardians to accept the terms of use for information and communication technology services, which describe the types of services used in teaching and the rules governing their use. According to the data controller, adherence to the terms of use is essential because the login credentials are also accessible outside of school hours. In the fall of 2025, the data controller submitted a report to the Office of the Data Protection Ombudsman detailing the applications it uses for educational purposes. According to the report, the data controller uses the following core Google services: Google Classroom, Google Drive, Google Docs/Sheets/Slides/Forms, Google Sites, Gmail, Google Calendar, Google Keep, and Google Meet. In addition to these core services, the school also uses, for example, Google Maps, Google Translate, Google Search, and (Google-owned) YouTube. Google Workspace for Education Plus licenses, which offer expanded service management and security features, were implemented on January 31, 2024. The data controller states that it conducts risk and threat assessments for the services before approving and implementing them. Applicable Legislation The General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation) and the National Data Protection Act (1050/2018), which further specifies it, apply to this matter. Article 5(1)(a) of the General Data Protection Regulation sets forth the principle of lawfulness. According to this article, personal data must be processed lawfully. Article 5(1)(c) of the Gen

Entities