• No results found

C USTOMER D ATA FROM THE C ORE S ERVICES , F EATURES AND THE G OOGLE A CCOUNT USED IN THE C ORE

11. L EGAL G ROUNDS

11.1 C USTOMER D ATA FROM THE C ORE S ERVICES , F EATURES AND THE G OOGLE A CCOUNT USED IN THE C ORE

As detailed in Section 4.2 of this report, Google does not offer an exhaustive list of specific and explicit purposes for which Google as a data processor necessarily has to process personal data in the Customer Data in the Core Services. Google claims it only acts on the ‘documented instructions’ of its customers.

This DPIA shows that Google factually processes the personal data in the Customer Data in the Core Services for at least 8, and possibly 20 purposes. These purposes are not specifically and explicitly enumerated as part of the documented instructions of the data controller. Google seems to deem these other purposes compatible with the catch-all purpose. As will be analysed in more detail in Section 13 of this report, the processing of personal data in the context of the G Suite (Enterprise) for Education services currently does not comply with the principle of purpose limitation.

Even if Google contractually guarantees its role as data processor for the personal data processed through the Features and Google Account when used in conjunction with a Core Service,297 the same lack of purpose limitation applies.

Without a specific purpose or specific purposes, it is impossible for universities to identify any appropriate legal ground.

If Google would indeed be a data processor, Google would be able to rely on the purposes and legal grounds for processing of the universities. However, as explained in the Sections 5.2 and 5.4, Google does not qualify as a data processor. Google and the universities are joint controllers, and this means the universities must have a legal ground for each purpose for which Google processes the personal data.11.1.1 Consent

Article 6 (1) (a) GDPR reads: “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”

297 See Sections 1.5.1, 1.5.2 and 1.5.3 of this report.

Article 4(11) GDPR defines consent as “consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”

As explained above, universities can currently not rely on any legal ground for the processing of personal data in the Customer Data in the Core Services, the Features and the Google Account when used in conjunction with the Core Services. This includes the legal ground of consent.

Even if Google and universities would agree on appropriate purpose limitation (as further discussed in Section 17), universities still cannot rely on consent as a legal ground, as explained below.

Universities should refrain from asking for consent from students and employees for the processing of their personal or confidential data. In view of the imbalance of power between employees and employers, and students and the universities, consent can seldom be given freely.298 Employees may not be free to refuse or withdraw consent for the processing of their personal data without facing adverse consequences.299

The fact that universities fulfil public tasks also makes it difficult to rely on consent for processing. In the context of Recital 43 of the GDPR, the EDPB explains: “whenever the controller is a public authority, there is often a clear imbalance of power in the relationship between the controller and the data subject.

It is also clear in most cases that the data subject will have no realistic alternatives to accepting the processing (terms) of this controller. The EDPB considers that there are other lawful bases that are, in principle, more appropriate to the activity of public authorities.”300

Another reason why consent is not a possible legal ground in this case, is that the Customer Data may contain personal data from other employees or other data subjects who may have had to provide personal data to, and communicate with, the universities.

Universities are not able to invite these other individuals to provide valid consent to Google for the processing of their personal data as part of the Customer Data.

There are more reasons why university employees are currently not in a position to provide valid consent for the processing of their personal data through G Suite (Enterprise) for Education. These relate to the requirements of specific, well-informed consent and the requirements of the ePrivacy Directive with regard to cookies and similar tracking technologies.

Google and universities as joint controllers

Because Google does not act as a data processor for these data, it cannot rely on its own legal ground.

In its current role as joint controller with the universities, Google does not obtain valid consent for the processing either.

298 Recital 49 of the GDPR: “In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.”

299 After completion of this DPIA, Google provided a last minute reply related to the legal ground of consent for minors. According to the proposed privacy amendment to SURF, universities and schools are required to obtain consent from the parents of children under 18 years for the use of any services outside of the Core Services. It is questionable if parents can freely provide valid consent for the use of Additional Services if the primary or secondary school doesn’t block this access, while it also needs to technically prevent simultaneous log-in with a private Google account to prevent spill-over of data from the education domain to the private domain.

300 EDPB, Guidelines on consent, paragraph 3.1.1.

As explained in Section 1.4.2, Google requires the creation of a Google Account as a prerequisite to the use the G Suite (Enterprise) for Education services. The end-user must click an ‘Accept’ button, referring to the Terms of Service and the (consumer) Privacy Policy. This does not meet the requirements of consent of the GDPR, for multiple reasons.

First, there is no specific and informed indication of the data subject’s wishes. As explained in Sections 4.2 and 4.3, the (consumer) Privacy Policy lists non-limitative, list of purposes that are not specific nor explicit. End-users do not know what they are agreeing to.

Second, merely clicking the ‘Accept’ button is not an indication that consent is freely given. There is no ‘Do not accept’ button. End-users cannot use the G Suite (Enterprise) for Education services if they do not accept the Terms of Service. Yet, their employer requires them to use the services in the context of their employment.301 Furthermore, the conflation of several purposes in the (consumer) Privacy Policy, without any attempt to seek granular consent, leads to a lack of freedom of choice for the data subject.302

Third, the indication is ambiguous, not given by a clear affirmation and not specific. The EDPB explains: “A controller must also beware that consent cannot be obtained through the same motion as agreeing to a contract or accepting general terms and conditions of a service. Blanket acceptance of general terms and conditions cannot be seen as a clear affirmative action to consent to the use of personal data.”303 As explained above, the ‘Accept’ button in Google’s welcome notice is a catch-all agreement to many terms.

Google’s procedure with regard to obtaining consent was the subject of a recent ruling of France’s highest administrative court, the Council of State. The court rejected Google’s appeal against a 50 million dollar fine imposed by the CNIL, the French Data Protection Authority.304 The fine was imposed because of a lack of consent for the use of personal data for advertising purposes when creating a Google Account on an Android device.

In paragraphs 22 and 23 the court summarises the problems with consent (emphasis added by the author):

22. (…) in order to create a Google Account necessary for the use of the Android operating system, the user is first presented with the 'Privacy Policy and Terms of Use', which briefly and very generally inform him or her of the nature of the data processed and the purposes of the processing carried out by Google.

The user can then click on a "more options" link or tick the boxes "I accept the Google terms of use" and

"I agree that my information will be used as described above and detailed in the Privacy Policy" to create his or her account. If the user clicks on the "more options" link, a page will prompt the user to set up their account. Under the title ‘personalization of ads’, a pre-ticked box, which he can uncheck, indicates that he agrees to display personalized ads. More information can be obtained by clicking on a "learn more"

link, which specifies how to display personalized ads, but this information is not exhaustive. However, if the user does not choose to click on the "more options" link on the first page presented to them, a "simple confirmation" window will appear, reminding the user that the account is configured to include

301 This could be different if universities would offer their employees an alternative to the use of G Suite (Enterprise) for Education. However, it is extremely unlikely that this will occur due to financial, security, operational and legal reasons.

302 EDPB, Guidelines on consent, paragraph 3.1.3.

303 Idem, paragraph 3.4.

304 Press release Council of State 19 June 2020, (in French) RGPD : le Conseil d’État rejette le recours dirigé contre la sanction de 50 millions d’euros infligée à Google par la CNIL, URL:

https://www.conseil- etat.fr/actualites/actualites/rgpd-le-conseil-d-etat-rejette-le-recours-dirige-contre-la-sanction-de-50-millions-d-euros-infligee-a-google-par-la-cnil. Decision: https://www.conseil-etat.fr/ressources/decisions- contentieuses/dernieres-decisions-importantes/conseil-d-etat-19-juin-2020-sanction-infligee-a-google-par-la-cnil

personalization features "such as recommendations and personalized ads". This page tells the user how to change these settings. The user can then return to the "more options" page or definitively confirm the creation of their account.

23. While the architecture described in the previous point means that the user is always invited to indicate that he agrees to his information being processed in accordance with the default settings of his account, i.e. including functions for personalizing the advertisements, the information available to him for this purpose is general and diluted in the middle of purposes that do not necessarily require consent as a legal basis, both at the first level of information and in the window entitled "simple confirmation". It thus appears that the information on the scope of the data processing for "targeted advertising" purposes provided at the first level is, in the light of the clarity and accessibility requirements recalled above, insufficient. In the absence of sufficient prior information, the consent collected in a global manner for all purposes, including this one, cannot be regarded as informed nor, consequently and in any case, as valid. If additional information on the targeted advertising purpose is provided at the second level (by clicking on "More options") and a specific consent for this purpose is then collected, it appears that this information is itself insufficient in view of the scope of the processing. Finally, consent is collected by means of a pre-checked box. In these circumstances, the CNIL's restricted panel rightly considered that the methods of collecting consent do not meet the requirements of the GDPR, which require a clear positive act, without the alleged circumstance that the regulation does not require separate collection of consent for the purpose of advertising targeting having any bearing on this point. (…)”

Even though the sign-up procedure for a Google Account in the G Suite (Enterprise) for Education environment is slightly different, as it involves a one-off pop-up Welcome notice with reference to the Terms of Service and (consumer) Privacy Policy (Figure 7 in this report), Google equally fails to collect valid consent from end-users. Google similarly asks for consent in a global manner for all purposes and all kinds of personal data and does not provide sufficiently precise and centrally organised information.

As explained above, even if Google would ask for consent in a specific, unambiguous manner, Google can never comply with the requirement that the affirmation is freely given, because end-users have no choice but to accept the (consumer) Privacy Policy. Therefore, Google cannot rely on consent of the data subject with respect to the personal data in Customer Data relating to the Google Account of end-users.

In reply to the table with high risks in this DPIA, Google has removed the ‘Accept’ button from the Google (Enterprise) for Education account application form.

11.1.2 Contract

Article 6 (1) (b) GDPR reads: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.”

The legal ground of necessity for the performance of a contract is limited to situations where organisations have an employment contract with specific data subjects, and the processing is strictly necessary to perform the contract with such individual data subjects. The European Data Protection Authorities explain: “The controller should be able to demonstrate how the main object of the specific contract with the data subject cannot, as a matter of fact, be performed if the specific processing of the personal data in question does not occur. Thus, this ground can never be invoked by a party that does not have its own contract with that individual.” 305

305 EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, paragraph 30. See also paragraph 26: “A controller can rely on

As explained above, universities can currently not rely on any legal ground for the processing of personal data. This includes the legal ground of necessity to perform a contract.

Universities may provide employees with the G Suite (Enterprise) for Education services to carry out the tasks included in their job description. As described in Section 6.1 of this report, Dutch universities have an interest in the ability for employees to seamlessly work at home with online collaboration tools, even more urgent since the outbreak of the COVID-19 pandemic.

To be able to successfully invoke this legal ground with respect to end-users (employees, students), the processing of the personal data in the Customer Data from the Core Services, the Features and the Google Account has to be strictly necessary for the performance of the contract with each individual data subject.

In practice, if a university allows its students and employees (or other temporary workers) to use Gmail, it is inevitable that the university also processes personal data about other data subjects who do not have a contractual relation with that government organisation.

The second, equally important, reason why this legal ground is not available, is because the processing has to be necessary in relation to each individual employee and student. The EDPB explains: “the controller should be able to demonstrate how the main subject-matter of the specific contract with the data subject cannot, as a matter of fact, be performed if the specific processing of the personal data in question does not occur. The important issue here is the nexus between the personal data and processing operations concerned, and the performance or non-performance of the service provided under the contract.”306

Taking this into account, universities may only base the processing on the legal ground of necessity to perform a contract with all of its employees if the processing is required in order to comply with the agreement. What purposes are necessary must be assessed on a case by case basis. Examples of purposes that may be necessary are:

• Technically delivering the Core Services, the Features and the Technical Support Services;

• (with respect to end-users) Enabling the use of the Core Services through the Google Account;

• Processing Customer Data from end-users or administrators to provide Technical Support Services upon their request (but not for the Customer Data relating to other data subjects);

• (with respect to admins and end-users): Following their instructions expressed by privacy settings .

Article 6(1)(b) to process personal data when it can, in line with its accountability obligations under Article 5(2), establish both that the processing takes place in the context of a valid contract with the data subject and that processing is necessary in order that the particular contract with the data subject can be performed [emphasis added by Privacy Company].” And paragraph 28: “the EDPB endorses the guidance previously adopted by WP29 on the equivalent provision under the previous Directive that ‘necessary for the performance of a contract with the data subject’: … must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data subject by the controller. Also the fact that some processing is covered by a contract does not automatically mean that the processing is necessary for its performance. […] Even if these processing activities are specifically mentioned in the small print of the contract, this fact alone does not make them ‘necessary’ for the performance of the contract.”

306 EDPB, Guidelines on processing under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, paragraph 2.4.

Other purposes, for example relating to security, may not require the processing of data of all individual employees. In that case, universities should rather rely on the public or legitimate interest ground for this purpose.

Because G Suite (Enterprise) for Education involves processing personal data of individuals that do not have a contract with the universities, and Google does not allow its customers to limit the data processing to the three valid contractual purposes, universities cannot successfully claim the legal ground of necessity for the performance of the contract for the processing of the Customer Data through G Suite (Enterprise) for Education.

In sum, the legal ground of contract cannot be invoked by universities for the processing of personal data of data subjects that do not have a contractual relationship with that institution. Furthermore, universities cannot invoke the legal ground of contract for the processing of personal data for purposes that are not necessary for the performance of the contract with each individual data subject.

Google and universities as joint controllers

Because Google does not act as a data processor for these data, it cannot rely on its own legal ground.

In its current role as joint controller with the universities, Google cannot rely on the legal ground performance of a contract.

In the Welcome notice for new end-users, Google writes: “If your organisation provides you access to the G Suite core services, your use of those services is governed by your organisation’s G Suite agreement.”

According to Google, the use of the Core Services is covered by the G Suite Agreement. As this is not a contract between Google and the end-user, Google cannot invoke ‘performance of a contract’ as

According to Google, the use of the Core Services is covered by the G Suite Agreement. As this is not a contract between Google and the end-user, Google cannot invoke ‘performance of a contract’ as