I NTERESTS IN THE DATA PROCESSING

In document DPIA on the use of Google G Suite (Enterprise) for Education (pagina 108-111)

This section outlines the different interests of Google and of the AUAS and UG in the use of G Suite (Enterprise) for Education. The interests of the Dutch universities may align with the interests of their students and employees, but this is not always the case. This section does not include an analysis of the fundamental data protection rights and interests of employees and students as data subjects.

How their rights relate to the interests of Google and the Dutch universities is analysed in part B of this DPIA.

6.1 Interests of the universities

Dutch universities have security, efficiency and compliance reasons to use cloud productivity software such as G Suite (Enterprise) for Education.

At the AUAS G Suite services are being used without official support. At the UG the free version of G Suite for Education is used. It follows from the interviews with employees from AUAS and UG that the G Suite services are being used by both employees and students to share personal data. It could be a security improvement to only share files with personal data via Drive, and not distribute files as attachments with mail. Many students and employees still share files via network drives for document storage or via local storage servers. In practice, employees increasingly share information via consumer versions of cloud products because existing solutions with network drives and local storage are not sufficient. Many people use, for example, Dropbox or WeTransfer to share files. This can result in a parallel network that the universities cannot manage. Preventing such a parallel network by offering a regulated Google service with Single Sign On is one of the main reasons for the AUAS to consider the use of G Suite Enterprise for Education.

It is a well-known IT problem to properly organise and manage the access authorisations for the network drives. If end-users have access to documentation to which they should not have access based on their role, this results in multiple security and privacy risks. In contrast to the network drives, Google offers transparency and controls about the rights that have been granted for access to the information. G Suite Enterprise for Education contains a number of features such as the Google Drive Access checker, Data Loss Prevention, Access Transparency, G Suite Security Centre, Admin Audit and Reports, and Shared Drives. These tools also allow end-users or admins, depending on the application, to see who has access to what information.

The universities have a strong interest in providing reliable, always on, well integrated and location independent productivity tools to their employees and students. Well-functioning also means that the software has to be accessible on different kinds of devices, and from different locations. The ability for employees and students to seamlessly work at home through for example collaboration tools like Google+, Groups for Business, Hangout and Classroom, is more urgent than ever since the outbreak of the COVID-19 pandemic.

The use of the webbased G Suite services may allow universities to cut back spending on the maintenance of desktops in offices, and potentially switch to the use of Chromebooks. Because G

Suite is widely used by consumers, employees may also require less IT support because they are already accustomed with the G Suite services

Additionally, the ability to access log data about end-user behaviour through the many different audit logs in G Suite Enterprise for Education is essential for universities to comply with their own obligations as data controllers to detect security incidents. By using log files such as the Drive and the Login audit logs the administrators can access data about end-users' sign-in attempts and access to personal data in files stored in Drive. This information is necessary to detect and mitigate possible security incidents and data breaches.

Furthermore, G Suite Enterprise for Education enables administrators to encrypt information on end-user devices. Especially on mobile devices, such encryption is required to minimise the risks of data breaches.

6.2 Interests of Google

Google has a strong financial and economic interest in selling customers a monthly cloud-based subscription service in order to increase its revenue.

Google also has an interest in using the data it collects or otherwise obtains through the provision of the G Suite services for many different purposes. Many of the 33 purposes in Google’s (consumer) Privacy Policy represent Google’s interest in using data, for example ‘Develop new products and features’ (purpose 5), ‘Use cookies for many purposes’ (purpose 29) and ’Performing research’.

Google has a business and marketing interest in differentiating between its consumer advertising revenue based business model, and its corporate cloud subscription based business model. In Google’s Cloud Privacy Principles252, Google promises, amongst others, not to process Customer Data for advertising, and to allow customers to control what happens with their data.

Google competes with Microsoft, that has similar offerings for consumer and business productivity software. Google has business and economic interests in continuing to improve and develop its services and products to stay competitive.

As a cloud provider, Google has a strong interest in promoting the security of its services to convince potential customers of the reliability and impenetrability of its services. Google writes: “Google employs more than 500 full-time security and privacy professionals, who are part of our software engineering and operations division. Our team includes some of the world’s foremost experts in information, application and network security.”253 Google also writes that this “security team actively scans for security threats using commercial and custom tools, penetration tests, quality assurance (QA) measures and software security reviews.”254

Google has a strategic commercial interest in attracting customers at a young age. The longer a user uses the same e-mail address, the higher the switching costs. According to the central IT support and procurement organisation for primary and secondary schools in the Netherlands, Kennisnet, Google has a market share of 70% with the ‘free’ services G Suite for Education.255 Bloomberg describes Google’s marketing strategy as follows: “Google doesn’t charge most schools to use Classroom. The real prize is the millions of young people learning how to use its software. When those students enter the

252 Google, Privacy, Google Cloud Trust Principles, URL: https://cloud.google.com/security/privacy

253 Google, Google Cloud Security and Compliance, URL: https://gsuite.google.com/learn-more/security/security-whitepaper/page-2.html

254 Idem.

255 Item in Dutch national newspaper De Volkskrant, Google wordt steeds grotere speler op scholen, tot zorg van privacyorganisaties, 1 november 2019, URL: https://www.volkskrant.nl/nieuws-achtergrond/google-wordt-steeds-grotere-speler-op-scholen-tot-zorg-van-privacyorganisaties~bae18dcd/

workforce, they’re likely to keep using paid versions, and encourage colleagues to adopt the tools, too.”256 As the Bloomberg article describes, this market share has only increased further due to the Covid-19 pandemic and the rapid switch schools and universities had to make to online teaching.The market share of Chromebooks has quadrupled in the last quarter of 2020.257 Additionally, the UK supervisory authority Ofcom for example has warned British telecom providers that most people are being put off switching providers to get better deals, because of the hassle of losing their email addresses.258 As Google attracts end-users in the Netherlands at a very young age, children become accustomed to a ‘free’ Gmail address at a very young age, which they may likely to keep on using when they grow up.

Google has a clear financial, business and economic interest in certain default settings. Google turns On Ad Personalization by default, and does not give administrators a central control to block this.

Google also allows end-users to log in with multiple Google Accounts simultaneously, thus allowing for spill-over from the educational to the consumer environment. Google. Some Additional Services contain and generate personalised advertising. As one of the world’s biggest ad networks, Google has a strong financial interest in the delivery of ads, in particular targeted ads. Google believes that by showing personalised ads it is delivering value to online end-users, since they do not have to pay with money for many services.259 In 2019, Google gained a revenue of approx. 134 billion US dollar with its advertising business.260 In 2019, Google cloud revenues amounted to only 5.5% of its global revenues.261 These cloud revenues consist primarily of revenues from Google Cloud Platform (GCP).

This includes infrastructure, data and analytics, and other services such as G Suite and other enterprise cloud services.262

6.3 Joint interests

The interests of Google and the universities align when it comes to the use of data for security purposes. An example is the use of Diagnostic Data to protect personal data stored in, or generated by the use of, the G Suite services against accidental or unlawful destruction, loss, alteration,

256 See for example Bloomberg, Google Classroom Users Doubled as Quarantines Spread, 9 April 2020, URL:

https://www.bloomberg.com/news/articles/2020-04-09/google-widens-lead-in-education-market-as-students-rush-online.

257 See for example NL Hardware info, Windows laptops verliezen significant marktaandeel, Chromebooks steeds populairder, 8 januari 2021, URL: https://nl.hardware.info/nieuws/74627/windows-laptops-verliezen-significant-marktaandeel-chromebooks-steeds-populairder#reacties Zie ook Nu.nl, 'Verkoop van

Chromebook afgelopen kwartaal verviervoudigd’, 31 januari 2021, URL:

https://www.nu.nl/tech/6113517/verkoop-van-chromebook-afgelopen-kwartaal-verviervoudigd.html.

258 BBC News, 22 February 2020, Email address charges branded 'daylight robbery', URL:

https://www.bbc.com/news/business-51571275

259 See for example Google, Our Privacy and Security Principles, URL: https://safety.google/principles/ “We also use data to serve more relevant ads. While these ads help fund our services and make them free for everyone, it’s important to clarify that our users’ personal information is simply not for sale.” Or Understanding how Google ads work, URL: https://safety.google/privacy/ads-and-data/ “We use data to make our services more useful and to show relevant advertising, which helps make our services free for everyone.”

260 Statista, Annual revenue of Google from 2002 to 2019, 5 February 2020, URL:

https://www.statista.com/statistics/266206/googles-annual-global-revenue/ In the most recently reported fiscal year, Google's revenue amounted to 160.74 billion US dollars. Google's revenue is largely made up by advertising revenue, which amounted to 134.81 billion US dollars in 2019. See also Alphabets 10K filing at the US Security and Exchange Commission over 2019, URL:

https://www.sec.gov/cgi-bin/viewer?action=view&cik=1652044&accession_number=0001652044-20-000008&xbrl_type=v. According to this filing, the revenue was 161.857 million USD.

261 Idem, Distribution of Google segment revenues from 2017 to 2019, URL:

https://www.statista.com/statistics/1093781/distribution-of-googles-revenues-by-segment/

262 Ibid.

unauthorized disclosure or access, and by restoring timely access to personal data following an incident.

Google’s interest in developing new services and improving or expanding functionalities can also be aligned with the interests of the Dutch universities, provided that such new services or improvements follow the restrictions set by administrators, and are not activated by default. Similarly, Google and universities’ interests may be aligned in the processing of some personal data by Google to deliver well-functioning (bug free) services, to prevent loss of labour capacity for the universities.

In sum, Google has financial, economic and commercial/business interests to provide secure and innovative services. Google also has strong commercial/business interests in default settings that allow frictionless use of its Additional Services and that maximise the collection of Diagnostic Data.

Some interests are consistent with the universities’ interests, but others are not.

In document DPIA on the use of Google G Suite (Enterprise) for Education (pagina 108-111)