In July 2022, Denmark's Data Protection Agency (Datatilsynet) effectively banned Google products from processing personal data in schools, with potential criminal penalties for violations.

The case originated in 2019, when a parent in Helsingor Municipality filed a complaint after their child unknowingly created a YouTube account through a school-issued Chromebook, resulting in the child's name being published publicly on YouTube.

A Predictable Outcome

The DPA's decision rested on several key findings:

Municipalities bear responsibility for ensuring that personal data processing meets standards of legality, fairness, and transparency. Google's track record on transparent data processing has been questionable at best.
Chromebooks serve as gateways to the broader Google ecosystem, which collects information for targeted marketing purposes. Google remains, at its core, an advertising company.
The DPA classified Google as a data controller, meaning there is no valid legal mechanism for municipalities to transfer personal data to Google for processing.
Google may be violating its own contractual commitments by using personal data for marketing or other unauthorized purposes, and no proper data processing agreements were established with the municipality. Numerous lawsuits related to Google tracking children's data support this concern.
The municipality may inadvertently process special category data through Google's platforms.
Data transfers to the United States remain problematic following the Schrems II ruling, which invalidated the EU-US Privacy Shield. There is currently no adequate legal mechanism to transfer EU personal data to US servers without supplementary measures, as outlined in EDPB recommendations.

What Happens Next?

The Danish DPA determined that Google's services fail to satisfy GDPR requirements. As a result, Helsingor Municipality must immediately cease all personal data transfers to the United States. Google Workspace has been banned outright. This ruling extends beyond a single municipality -- the DPA expects all Danish municipalities to comply with these findings.

Any ongoing transfer of personal data to US-based servers has been suspended until full compliance with Chapter V of the GDPR can be demonstrated. Given the current legal landscape, achieving such compliance through Google's services appears highly impractical.

Penalties for Non-Compliance

Under the Danish Data Protection Act, Section 41, subsection 2, no. 4, violating a ban issued by the DPA carries penalties of fines or imprisonment for up to 6 months.

Why Schools Need to Move Away from Google

Many open-source alternatives exist for educational technology. Platforms like Moodle offer viable e-learning solutions that can be hosted within the EU. The question remains: why do schools and governments continue gravitating toward services run by advertising companies?

Regardless of where you stand on the GDPR and EU regulations, holding schools accountable for the tools they expose children to is essential. An advertising company with a documented history of privacy violations should not have insight into children's online activities.

Digital privacy cannot remain a "nice to have" feature. It must be treated as a fundamental right, particularly for children who have no say in what tools their schools require them to use.