IMY (Sweden) - IMY-2023-1647: Difference between revisions

From GDPRhub
(Created page with "{{DPAdecisionBOX |Jurisdiction=Sweden |DPA-BG-Color= |DPAlogo=LogoSE.png |DPA_Abbrevation=IMY |DPA_With_Country=IMY (Sweden) |Case_Number_Name=IMY-2023-1647 |ECLI= |Original_Source_Name_1=IMY-2023-1647 |Original_Source_Link_1=https://www.imy.se/globalassets/dokument/beslut/2023/beslut-om-tillsyn-barn-och-utbildningsforvaltningen-ostersunds-kommun.pdf |Original_Source_Language_1=Swedish |Original_Source_Language__Code_1=SV |Original_Source_Name_2= |Original_Source_Link...")
 
No edit summary
Line 59: Line 59:
}}
}}


The Swedish DPA fined Östersund's Childrens and Education Board 300,000 SEK (around €26,524) for failing to conduct a data protection impact assesment, as required by [[Article 35 GDPR#1|Article 35(1) GDPR]], prior to installing Google Workspace for Education.
The Swedish DPA fined Östersund's Childrens and Education Board 300,000 SEK (around €26,524) for breaching Article 35(1) GDPR. The Board failed to conduct a data protection impact assesment prior to using Google Workspace for Education in schools.


== English Summary ==
== English Summary ==


=== Facts ===
=== Facts ===
Östersund has twenty-four schools that use Google Workspace since 2020. It is employed for communicating, teaching, and assigning and turning in homework. Google Workspace processed the personal data of 1,303 employees and 5,945 students, including names, email addresses, and class and group memberships. The Childrens and Education Board of the muncipality of Östersund is the data controller for the processing of personal data when the schools use Google Workspace.
Östersund has twenty-four schools that use Google Workspace since 2020. It is employed for communicating, teaching, and assigning and turning in homework. Google Workspace processes the personal data of 1,303 employees and 5,945 students, including names, email addresses, and class and group memberships. The Childrens and Education Board of the muncipality of Östersund holds itself out as the data controller for the processing of personal data when the schools use Google Workspace.


In 2014 an impact assesment was conducted for google apps education. It was
In 2014 a different entity in Östersund  (the regional Council of Jämtland County) conducted an impact assesment on google apps in education and determined that it could be used. In 2020, The Childrens and Education Board of the muncipality of Östersund decided to integrate Google Workspace into their own systems and schools but did not conduct an impact assesment, believing that the 2014 assesment was sufficient.  
 
It was only after the integration of Google Workspace into both their own systems and schools that the Board initated an impact assesment. This process has been ongoing for three years. The Board wrote to the DPA and explained that parts of the impact assesment had been reported and acted upon. For example, policy documents have been established, training courses developed and storage restrictions implemented. They also noted that the impact assessment has so far revealed the same concerns as the 2014 report. The only question was whether using Google Workspace required the transfer of personal data to a third country (a nation outside the EU/EEA).


=== Holding ===
=== Holding ===
X
The DPA


== Comment ==
== Comment ==

Revision as of 14:04, 5 December 2023

IMY - IMY-2023-1647
LogoSE.png
Authority: IMY (Sweden)
Jurisdiction: Sweden
Relevant Law: Article 35(1) GDPR
Type: Investigation
Outcome: Violation Found
Started:
Decided:
Published:
Fine: 300,000 SEK
Parties: n/a
National Case Number/Name: IMY-2023-1647
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Swedish
Original Source: IMY-2023-1647 (in SV)
Initial Contributor: sh

The Swedish DPA fined Östersund's Childrens and Education Board 300,000 SEK (around €26,524) for breaching Article 35(1) GDPR. The Board failed to conduct a data protection impact assesment prior to using Google Workspace for Education in schools.

English Summary

Facts

Östersund has twenty-four schools that use Google Workspace since 2020. It is employed for communicating, teaching, and assigning and turning in homework. Google Workspace processes the personal data of 1,303 employees and 5,945 students, including names, email addresses, and class and group memberships. The Childrens and Education Board of the muncipality of Östersund holds itself out as the data controller for the processing of personal data when the schools use Google Workspace.

In 2014 a different entity in Östersund (the regional Council of Jämtland County) conducted an impact assesment on google apps in education and determined that it could be used. In 2020, The Childrens and Education Board of the muncipality of Östersund decided to integrate Google Workspace into their own systems and schools but did not conduct an impact assesment, believing that the 2014 assesment was sufficient.

It was only after the integration of Google Workspace into both their own systems and schools that the Board initated an impact assesment. This process has been ongoing for three years. The Board wrote to the DPA and explained that parts of the impact assesment had been reported and acted upon. For example, policy documents have been established, training courses developed and storage restrictions implemented. They also noted that the impact assessment has so far revealed the same concerns as the 2014 report. The only question was whether using Google Workspace required the transfer of personal data to a third country (a nation outside the EU/EEA).

Holding

The DPA

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.