[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHQaC1nhXpFmW0t-8s20b9xSQy0XIyKc8o827fa3odAk":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"3d140027-937b-4d7f-b4cf-1d297102566a","Tietosuojavaltuutetun toimisto (Finland) - TSV\u002F40\u002F2018","tietosuojavaltuutetun-toimisto-finland-tsv-40-2018-24fa8e","Facts ← Older revision Revision as of 12:01, 28 September 2026 (One intermediate revision by the same user not shown) Line 95: Line 95: In April 2018, the DPA received a complaint stating that the city of Espoo (the controller) was using Google's digital learning tools in a school without obtaining consent from pupils’ (the data subjects’) parents. In April 2018, the DPA received a complaint stating that the city of Espoo (the controller) was using Google's digital learning tools in a school without obtaining consent from pupils’ (the data subjects’) parents. The controller clarified that it used a number of Google applications for educational purposes, including Google Classroom, Google Drive, and Google Docs. It invoked [[Article 6 GDPR|Article 6(1)(c) GDPR]] as the legal basis for the processing. According to the controller, the processing of personal data in connection with using these services was necessary to comply with the obligation to provide basic education laid down in the Finnish Basic Education Act. The controller clarified that it used a number of Google applications for educational purposes, including Google Classroom, Google Drive, and Google Docs. It invoked [[Article 6 GDPR|Article 6(1)(c) GDPR]] as the legal basis for the processing. According to the controller, the processing of personal data in connection with using these services was necessary to comply with the obligation to provide basic education laid down in the [https:\u002F\u002Fwww.finlex.fi\u002Ffi\u002Flainsaadanto\u002F1998\u002F628 Finnish Basic Education Act]. The DPA issued a decision in case 1509\u002F452\u002F18 in December 2021. This decision was appealed to the Supreme Administrative Court, which referred the case back to the DPA in its decision [[KHO - KHO:2025:29|KHO:2025:29]] in April 2025. The Supreme Administrative Court held that the DPA could not conclude [[Article 6 GDPR|Article 6(1)(c) GDPR]] was not applicable in any respect as a legal basis for the processing. The DPA issued a decision in case 1509\u002F452\u002F18 in December 2021. This decision was appealed to the Supreme Administrative Court, which referred the case back to the DPA in its decision KHO:2025:29 in April 2025. The Supreme Administrative Court held that the DPA could not conclude [[Article 6 GDPR|Article 6(1)(c) GDPR]] was not applicable in any respect as a legal basis for the processing. In the present proceedings, the DPA was to decide the extent to which the controller could invoke the compliance with a legal obligation as a legal basis for the processing of personal data related to the use of Google’s digital learning tools. In the present proceedings, the DPA was to decide the extent to which the controller could invoke the compliance with a legal obligation as a legal basis for the processing of personal data related to the use of Google’s digital learning tools. === Holding === === Holding === The DPA ordered the controller to ensure that the personal data of pupils collected in connection with the use of Google's digital learning tools was solely processed for the purpose of fulfilling the controller's educational obligations. The processing could be based on Article 6(1)(c) only under these conditions. The DPA ordered the controller to ensure that the personal data of pupils collected in connection with the use of Google's digital learning tools was solely processed for the purpose of fulfilling the controller's educational obligations. The processing could be based on [[Article 6 GDPR|Article 6(1)(c) GDPR]] only under these conditions. The DPA held that the controller could invoke Article 6(1)(c) as a legal basis for the use of learning tools essential to teaching. In addition, the processing must be carried out solely to fulfill educational obligations. The DPA pointed out that this legal basis applies to the use of tools that are central to teaching, such as text editors, calendars, email, presentation software, and programs intended for subject-specific instruction (such as language or math applications). The DPA held that the controller could invoke [[Article 6 GDPR|Article 6(1)(c) GDPR]] as a legal basis for the use of learning tools essential to teaching. In addition, the processing must be carried out solely to fulfill educational obligations. The DPA pointed out that this legal basis applies to the use of tools that are central to teaching, such as text editors, calendars, email, presentation software, and programs intended for subject-specific instruction (such as language or math applications). When assessing the necessity requirement, the DPA took into account that digital learning tools can enable the extensive and long-term collection and other processing of school-aged children’s personal data by and for the benefit of external entities. Therefore, it held that the controller may not disclose or otherwise grant access to this data to the controller or other parties in a way that allows the controller to process the data for its own purposes, such as developing the learning tools or other services. When assessing the necessity requirement, the DPA took into account that digital learning tools can enable the extensive and long-term collection and other processing of school-aged children’s personal data by and for the benefit of external entities. Therefore, it held that the controller may not disclose or otherwise grant access to this data to the controller or other parties in a way that allows the controller to process the data for its own purposes, such as developing the learning tools or other services.","Finland's Data Protection Authority (DPA) has ordered the city of Espoo to ensure that pupil personal data collected through Google's digital learning tools is processed solely for educational obligations. The DPA found that while Article 6(1)(c) of GDPR could be a legal basis for using essential teaching tools, the city had not adequately limited data processing for its own purposes. This decision stems from a 2018 complaint regarding the use of tools like Google Classroom and Drive without parental consent.","Finland's DPA orders city to limit pupil data processing via Google learning tools.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_TSV\u002F40\u002F2018&diff=53198&oldid=53196","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FLogoFI.png","2026-09-28T12:01:43+00:00","2026-09-28T18:00:34.238271+00:00",7,[17,20,23,25],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Google Classroom","product",{"name":24,"type":22},"Google Drive",{"name":26,"type":22},"Google Docs","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":27,"icon":29,"name":30,"slug":31},null,"Policy","policy",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[],[18,21,24],{"controls":51,"vendors":130},[52,81,104],{"slug":53,"name":54,"problem":55,"products":56},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"slug":82,"name":83,"problem":84,"products":85},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[86,92,99],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":87,"product_name":88,"url":90,"description":91},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":94,"url":97,"description":98},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":100,"product_name":101,"url":102,"description":103},"falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"slug":105,"name":106,"problem":107,"products":108},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[109,114,122],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":110,"product_name":111,"url":112,"description":113},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":145},"finnish-dpa-orders-espoo-to-restrict-google-tools-data-processing-for-students","Finnish DPA Orders Espoo to Restrict Google Tools Data Processing for Students","The city of Espoo failed to adequately define and limit the legal basis for processing children's personal data when deploying third-party educational tools like Google Classroom and Drive. While GDPR Article 6(1)(c) may justify essential teaching functions, the city did not ensure that Google was prohibited from using pupil data for its own commercial purposes, creating a compliance gap. This matters because children represent a particularly vulnerable data subject category, and schools acting as data controllers bear responsibility for how processors handle that data. Failing to conduct proper Data Protection Impact Assessments (DPIAs) and vendor due diligence before deployment exposes institutions to regulatory sanctions and erodes public trust.",[136,137,138,139,140,141,142,143,144],"GDPR Article 6(1)(c) – Lawfulness of processing","GDPR Article 28 – Processor obligations and contracts","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Recital 38 – Special protection for children's personal data","NIST Privacy Framework PR.P-P4 – Data processing policies","NIST SP 800-53 PT-2 – Authority to Process Personally Identifiable Information","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management","ITIL Service Design – Supplier Management",{}]