Enforcement action improves privacy for children in education: more is needed
Regulatory and enforcement actions stemming from work carried out in the Netherlands, have led to improvements in Google’s data practices and policies. This brief published by the joint LSE and 5Rights Digital Futures for Children research centre identifies some of the key changes and remaining challenges. Most notable changes include:
- Google Workspace for Education Service Data Addendum: an additional contract to enable a school to choose to be a controller of service data instead of Google, with Google as a joint controller for some purposes;
- Supplemental Google Cloud Privacy Notice: applied specifically to organisations that have adopted the Google Workspace for Education Service Data Addendum, this notice emphasises the duty of the organisation to notify the individual with information about how it processes service data and legal rights and directs individuals to review their organisation’s own policies and/or privacy notices;
- Amendments to Google’s General Privacy Policy: the general Privacy Policy applies in Additional Services, with significant changes for the better.
While these improvements are a step in the right direction, the onus still lies too much with schools and parents. This latest brief reiterates the need that steps should be taken to redress these problems, and that this requires a regulatory response.
