Skip to main content
Go back
Written by
Digital Futures for Children centre
4th July, 2024

DFC on EdTech and the impact of enforcement action

The joint LSE and 5Rights Digital Futures for Children research centre has recently published a report on international regulatory decisions concerning EdTech companies’ data practices and a brief analysis of recent changes to policies and practices in Google’s Workspace for Education.

Four black children are looking at a laptop in a classroom, and one of them is touching the trackpad.

Recent regulatory decisions across the world highlight the increasing global concerns about the data practices of EdTech companies in schools.

The new report by the joint LSE and 5Rights Digital Futures for Children research centre shines a light on key issues surrounding EdTech, namely surveillance and profiling of children in education for commercial purposes, data transfers made with inadequate protection, a lack of transparency by tech companies as to data collection, and failures to properly restrict the purposes for which children’s data could be used.

An analysis of regulatory and legal actions in different countries shows that EdTech companies have breached data protection laws, with schools and local authorities bearing the consequences of legal obligations as the responsibility falls on them as data controllers. However, schools often have insufficient control over how EdTech companies handle children’s data and lack the knowledge and resources to meet the requirements set out by GDPR.

The Case of Google’s Workspace for Education

Regulatory and enforcement actions stemming from work carried out in the Netherlands, have led to improvements in Google’s data practices and policies. This brief published by the joint LSE and 5Rights Digital Futures for Children research centre identifies some of the key changes and remaining challenges. Most notable changes include:

  • Google Workspace for Education Service Data Addendum: an additional contract to enable a school to choose to be a controller of service data instead of Google, with Google as a joint controller for some purposes;
  • Supplemental Google Cloud Privacy Notice: applied specifically to organisations that have adopted the Google Workspace for Education Service Data Addendum, this notice emphasises the duty of the organisation to notify the individual with information about how it processes service data and legal rights and directs individuals to review their organisation’s own policies and/or privacy notices;
  • Amendments to Google’s General Privacy Policy: the general Privacy Policy applies in Additional Services, with significant changes for the better.

While these improvements are a step in the right direction, the onus still lies too much with schools and parents. This latest brief reiterates the need that steps should be taken to redress these problems, and that this requires a regulatory response.