1. T HE PROCESSING OF PERSONAL DATA
1.6 T HE ENROLMENT FRAMEWORK FOR G S UITE (E NTERPRISE ) FOR E DUCATION
Google generally offers G Suite Enterprise as an online enrollment, that can be procured on its website. However, large customers such as SURF, a cooperative association of Dutch educational and research institutions,83 may enter into a specific offline agreement called the Cloud Master Agreement.
In Clause 2.1 of the G Suite DPA Google explains that there are different types of enrollment agreements: “G Suite Agreement” means a G Suite Agreement; a G Suite for Education Agreement; a
83 SURF consists of universities, universities of applied sciences, senior secondary vocational institutions (MBO), UMCs and research institutions. They work together to purchase or develop the best possible digital services and to stimulate knowledge sharing by continuing to innovate. For more information see:
https://www.surf.nl/en/about-surf/the-surf-cooperative
Google Cloud Master Agreement with G Suite Services Schedule; or any other agreement under which Google agrees to provide any services described in the G Suite Services Summary to Customer.”84 SURF has not (yet) negotiated a central framework enrolment with specific data protection amendments for G Suite (Enterprise) for Education. Therefore the analysis below is based on Google’s publicly available documents.
This report uses the most recently available versions of the G Suite for Education (Online) Agreement (February 2020)85 and other relevant documents with data protection terms.
1.6.1 Relevant data protection terms and conditions
The following documents contain data protection terms for G Suite (Enterprise) for Education:
• G Suite DPA for G Suite Enterprise for Education86 or G Suite for Education Privacy Notice87,
• G Suite EU Model Contract Clauses (separate agreement entered by Google LLC with the customer)
• G Suite Service Specific Terms88
• G Suite [Core] Services Summary89
• Google Additional Product Terms90
• G Suite Acceptable Use Policy91
• G Suite Technical Support Services Guidelines (TSS)92 +
• Google Privacy Policy for end-users93
• Google Terms of Service for end-users94
The hierarchy of the documents in this framework is determined in the Terms of Service G Suite for the EEA, in Section 18.5:
84 Data Processing Amendment to G Suite and/or Complementary Product Agreement (Version 2.2), Section 2.1 Definitions, URL: https://gsuite.google.com/terms/dpa_terms.html, hereinafter: G Suite DPA. Since February 2021, Google publishes DPA version 2.3, to reflect the name change from G Suite to Google Workspace.
85 Google for Education Terms of Service. Previously available at URL:
https://gsuite.google.com/terms/education_terms.html . Copy available in the Wayback Machine of the Internet Archive, snapshot made on 16 February 2020, URL:
https://web.archive.org/web/20200216220917/https://gsuite.google.com/terms/education_terms.html. The new Terms of Service for Google Workspace for Education are available at:
https://workspace.google.com/terms/education_terms.html.
86 Idem, G Suite DPA.
87 Google G Suite for Education Privacy Notice, URL:
https://gsuite.google.com/intl/en/terms/education_privacy.html . After completion of this DPIA, Google has replaced this document by the Google Workspace for Education Privacy Notice.
88 G Suite Service Specific Terms, URL: https://gsuite.google.com/terms/service-terms/ /
89 G Suite Services Summary, URL: https://gsuite.google.com/terms/user_features.html
90 Google Cloud Additional Product Terms, URL:
https://gsuite.google.com/intl/en/terms/additional_services.html
91 Google G Suite Acceptable Use Policy, URL: https://gsuite.google.com/terms/use_policy.html l
92 Google, G Suite Technical Support Services Guidelines, URL: https://gsuite.google.com/terms/tssg.html
93 Google Privacy Policy. The version used for this report was last updated 31 March 2020, available at https://policies.google.com/privacy?hl=en#intro. URL last visited on 17 June 2020).
94 Google (consumer) Terms and Services. The version used for this report was last updated on 31 March 2020, available at https://policies.google.com/terms (URL last visited 25 February 2021).
"If there is a conflict among the documents that make up the Agreement, then the documents will control in the following order: the Data Processing Amendment, the applicable Order Form, the remainder of this Agreement, the URL Terms and any other terms incorporated by reference into the Agreement."95
Figure 14: applicable privacy rules G Suite Enterprise for Education
The G Suite (Enterprise) for Education DPA also states in Section 15:
“Notwithstanding anything to the contrary in the applicable Agreement, to the extent of any conflict or inconsistency between the terms of this Data Processing Amendment and the remainder of the applicable Agreement, this Data Processing Amendment will govern. For clarity, if Customer has entered
95 G Suite Terms of Service.
more than one Agreement, this Data Processing Amendment will amend each of the Agreements separately.”96
Alternatively, if an institution would choose the ‘free’ G Suite for Education services, the hierarchy of the documents is determined in Art. 15.14 of the G Suite Education Agreement:
"Interpretation of Conflicting Terms. If there is a conflict between the documents that make up this Agreement, the documents will control in the following order: the Order Form (if applicable), the Agreement, and the terms located at any URL."97
In the G Suite Education Agreement Google determines:
“Privacy Notice. The G Suite for Education Privacy Notice governs how Google collects and uses information from Customer or End-users.”98
In the G Suite for Education Privacy Notice Google explains that processing of ‘user personal information’ in the Core Service is governed by the G Suite DPA.
“The G Suite for Education Core Services (“Core Services”) are listed in the Services Summary and include Gmail, Calendar, Classroom, Contacts, Drive, Docs, Forms, Groups, Sheets, Sites, Slides, Talk/Hangouts, Vault, and Chrome Sync. These services are provided to a school under its G Suite for Education agreement and, as applicable, Data Processing Amendment. (Users and parents can ask their school if it has accepted the Data Processing Amendment.)”
Google also explains in the G Suite for Education Privacy Notice:
“Where there are terms that differ, as with the limitations on advertising in G Suite for Education, the G Suite for Education agreement (as amended) takes precedence, followed by this Privacy Notice and then the Google Privacy Policy.”
Note: after completion of this report in July 2020, Google published new documents and negotiated a privacy amendment with SURF and the Dutch government. These improvements are described in the new assessment of the risks added to the summary and conclusion of this report in February 2021.
1.6.2 Google Account
The G Suite DPA only applies to the Customer Data in the Core Services. 99 The G Suite DPA does not apply to the processing in connection with a Google Account (though Google has explained in reply to this DPIA that the G Suite DPA does apply when the Account is used in conjunction with a Core Service100), or to the use of the Additional Services, such as YouTube, Maps and Search.
96 G Suite DPA.
97 G Suite Education Agreement.
98 Ibid.
99 As well as services identified as ‘Other Services’ in the G Suite Services Summary and services described in the Complementary Product Services provided under a separate agreement. These services are out of scope of this DPIA.
100 Google explains in the new Google Workspace Data Protection Implementation Guide for Education, published in February 2021: “When a user signs in to their new organization managed Google Account you created, they receive a notice explaining how their data is collected and accessed by their admin , and how their use of Google Workspace for Education Core Services is governed by your organization’s Google Workspace for Education terms.” URL:
https://services.google.com/fh/files/misc/google_workspace_edu_data_protection_implementation_guide.p df .
Google explains: “These products [Additional Services] are not part of the G Suite offering and are not covered by the G Suite (Enterprise) for Education DPA.”101
Google explained to the researchers that there is a hard distinction between the Core G Suite (Enterprise) for Education services and the many consumer services Google offers globally.102
In the new Google Terms of Service (effective 31 March 2020), Google explains that these consumer terms apply to the data processing as a result of the use of the Additional Services.103 All end-users with a Google Account must accept these (consumer) Terms of Service, regardless if they create the account as a consumer or as an employee in the educational environment. Google explains that this is because their G Suite credentials may be used to sign into and use consumer services if their IT administrator does not restrict such use.104
Google explains to administrators that they can disable access to the Additional Services if they cannot bind their end-users (university employees) to these terms.
“If Customer does not wish to enable any Additional Products, or if you are acting on behalf of Customer but do not have the requisite authority to bind Customer to these Additional Product Terms, please disable such Additional Products via the functionality of the Services.”105