IMY (Sweden) - IMY-2023-1647
| IMY - IMY-2023-1647 | |
|---|---|
 | |
| Authority: | IMY (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 35(1) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | 300,000 SEK |
| Parties: | n/a |
| National Case Number/Name: | IMY-2023-1647 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Swedish |
| Original Source: | IMY-2023-1647 (in SV) |
| Initial Contributor: | sh |
The Swedish DPA fined Östersund's Childrens and Education Board 300,000 SEK (around €26,524) for breaching Article 35(1) GDPR. The Board failed to conduct a data protection impact assesment prior to using Google Workspace for Education in schools.
English Summary
Facts
Östersund has twenty-four schools that use Google Workspace since 2020. It is employed for communicating, teaching, and assigning and turning in homework. Google Workspace processes the personal data of 1,303 employees and 5,945 students, including names, email addresses, and class and group memberships. The Childrens and Education Board of the muncipality of Östersund holds itself out as the data controller for the processing of personal data when the schools use Google Workspace.
In 2014 a different entity in Östersund (the regional Council of Jämtland County) conducted an impact assesment on google apps in education and determined that it could be used. In 2020, The Childrens and Education Board of the muncipality of Östersund decided to integrate Google Workspace into their own systems and schools but did not conduct an impact assesment, believing that the 2014 assesment was sufficient.
It was only after the integration of Google Workspace into both their own systems and schools that the Board initated an impact assesment. This process has been ongoing for three years. The Board wrote to the DPA and explained that parts of the impact assesment had been reported and acted upon. For example, policy documents have been established, training courses developed and storage restrictions implemented. They also noted that the impact assessment has so far revealed the same concerns as the 2014 report. The only question was whether using Google Workspace required the transfer of personal data to a third country (a nation outside the EU/EEA).
Holding
The DPA
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
