16 ms·

Dutch schools must stop using Google's email and cloud due to privacy concerns

288 points by starsep 4y ago

gidorah 4y ago
I am a UK college governor, and have bought up the GDPR issues that have come up with Google and Microsoft recently. Whilst I do get some nonsensical response, that big tech have great security, it does feel really lainful that there is basically no alternative. I really want there to be, but there just isn't a viable alternative.
- ChuckNorris89 4y ago
  >I really want there to be, but there just isn't a viable alternative. There isn't? My Eastern European highschool had self hosted email since as far as I can remember hosted on some pentium PCs. The issue isn't that there's no alternative, the issue is that, schools are unable or unwilling to bother doing things themselves and instead just go with Apple, Google, Microsoft, because it's easy and almost free.
  - yazzku 4y ago
    Almost free? Microsoft charges hefty licenses and basically re-sales the same product multiple times. I believe Google also charges schools and universities a hefty monthly fee for the services.
  - googlryas 4y ago
    If student privacy is the concern, do you think going with something self hosted is a better idea than sticking with Google? In reality, the concern seems to be the law will not legally allow them to continue operating unless Google clarifies where the data is processed.
    - Rygian 4y ago
      Sticking with Google means students have no privacy, due to the US government being able to summarily monitor their Google data. Even if Google promises the processing happens in Europe. It's not "clarify where the data is processed" but rather "make sure it's not processed by an US-owned corp" (not to say that any other country is fine, their laws must be compatible with GDPR).
  - almog 4y ago
    I guess that would work great even today for _internal_ emails, but as soon as they'll need to deliver emails to any address that's hosted behind gmail, outlook and probably other dominant players, there's a long list of configurations to make and maintain so that outgoing emails don't get bounced.
    - Aeolun 4y ago
      If I can do it, surely someone whose entire job is doing it should be able to?
      - AlchemistCamp 4y ago
        If only the world were like that.
      - fcatalan 4y ago
        My entire job was doing that for a university for a few years. You won't catch me doing it again even for 2x my current salary.
      - freeflight 4y ago
        That assumes schools have dedicated IT positions, when its very common for the school IT to be managed part-time by teachers themselves, as often there ain't enough money for a dedicated IT position.
        Aeolun 4y ago
        I’ve never seen that tbh. Any school I’ve been at has had dedicated IT personnel. Fairly well paid too.
      - 2000UltraDeluxe 4y ago
        I, and many others do. We barely manage. Email deliverability is _hard_.
        dijit 4y ago
  - gidorah 4y ago
    Unfortunately, schools do have budget constraints, so "almost free" is very, very attractive.
- ls15 4y ago
  > but there just isn't a viable alternative. Why can't the state build a data center and host some Matrix, Nextcloud and Moodle instances? To me that would seem like tax money being used as intended by the taxpayer.
  - jeffbee 4y ago
    This kind of response always baffles me. Choose any of the common questions people have about cloud data privacy and ask the same question about Nextcloud. For example: when I delete a file does the cloud really delete it? Now read the Nextcloud source code. All it does is unlink files, and it doesn't even do that properly because it doesn't handle errors and races. Also, it poops your private data all over the filesystem while creating thumbnails and previews. So the answer is no, absolutely not even a single iota of effort has been expended making sure deleted data is really deleted, and inside administrators will have complete and total, unaudited access to it. Switching from a cloud run by professionals to a self-hosted Nextcloud would be a massive downgrade in information privacy.
    - cmroanirgo 4y ago
      The thing is, there's no gaurantee that google nor microsoft nor apple do anything more. With products like nextcloud, at least you can see exactly what's going on. We already know google, microsoft and apple have unfettered access to your data too. With self hosting, at least I have a chance of knowing when my data's being monitored & I can choose increasingly severe security around that system. The big players can only offer promises with little to no way for us to verify the truth of any one of their statements. So, unless the big players offer e2ee as a default, it's best to assume the worst from them. With nextcloud it's far less necessary if you're rolling your own (but it supports a form of encryption anyhow)
      - jeffbee 4y ago
        > at least I have a chance of knowing when my data's being monitored C'mon really. The whole central point of this euro scaremongering is that Google will turn over your data to intelligence agencies when U.S. court orders it to do so. Now imagine that for whatever fanciful and obviously highly unlikely reason the C.I.A. wants your PDFs. You are claiming this will be visible to you, that you will be able to defend yourself against hardware supply chain attacks, attacks on the media you downloaded to install CrapNux on your servers, attacks against your NextCloud auto-updates, attacks against the whole rest of your software supply chain, social engineering attacks against your sysadmins, attacks against your hard disk drive waste stream, and all the rest of it? And you will be able to achieve this on the budget on a Dutch primary school? Look, I think it would be cool if nation-sized bureaucracies had the doctrines and practices that allowed them to be actually safer than the cloud, but as it stands they do not.
- avianlyric 4y ago
  Well good news! Our wonderful government has great plans to scrap GDPR and all the silly European bureaucracy slowing down business, and replace it with… checks notes …better British bureaucracy that will cost just as much, while eradicating our rights to privacy… It’s a Brexit benefit or something.
- stjohnswarts 4y ago
  Do GPDR rules even apply in Britain any longer given that it's split from the EU is 100% now?
  - vinay427 4y ago
    As far as I can tell, yes. It was implemented in the UK (as in EU countries) by incorporating it into national law, but can be reviewed at a later date as some UK politicians have claimed to support. https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-and-the-eu-in-detail/the-uk-gdpr/ https://ico.org.uk/for-organisations/dp-at-the-end-of-the-tr...
    - M2Ys4U 4y ago
      >It was implemented in the UK (as in EU countries) by incorporating it into national law That's not how it worked. The GDPR is a regulation which means that it applies as-is in all EU member states without being incorporated in to national laws. It is only directives that need to be incorporated in to national law (a process known as "transposition"). As far as the UK goes, because the GDPR was in force at the time of Brexit it continued to apply (the same with almost all EU law), although it was amended so that it didn't reference EU institutions any more (like removing the bits that talked about the EDPB or collaboration with other EU supervisory authorities, replacing references to the Commission with the Secretary of State and other things like that).
      - vinay427 4y ago
        I believe you're mostly right, so I stand corrected; apologies for the error. However, the Data Protection Act 2018 [1] does complement and supplement the GDPR in UK national law, including certain data not covered by GDPR, and more specifically apparently "implements those parts of the GDPR which 'are to be determined by Member State law'". This was before Brexit took place, and it was later amended to reflect non-EU status at the start of 2021. [1] https://en.wikipedia.org/wiki/Data_Protection_Act_2018 https://en.wikipedia.org/wiki/Data_Protection_Act_2018
  - 4y ago
- sjamaan 4y ago
  If self hosting is not an option, there are European mail providers, who must be GDPR compliant. The biggest one being ProtonMail.
- pelasaco 4y ago
  That was exactly my impression in Germany too. You can search my answer in this thread discussing my whole experience. It is depressing to see this whole argumentation as main blocker to a digital breakthrough. The funniest anecdote was one of the most zealous person against google in the set of meetings that I took place about this topic, used google maps to reach the building where we held the showcases and demos.
twiss 4y ago
I went to a Dutch high school that used Google Accounts for email, and they once caught some students "cheating" on a group project (i.e. collaborating in larger groups than they were meant to collaborate in, I guess) via email. This made me suspect that the admins could read our school email (which people also used to talk about various other stuff, which I guess was unwise). I don't know if that was actually how they found out, but it made me very conscious of email privacy (or lack thereof). Now I work at ProtonMail, so go figure.
- jeffbee 4y ago
  Yeah of course, gsuite administrators can access everything, and because gsuite admins are just modern-day instances of bofh-type obnoxious IT guys, there's no way you'll convince them to give up those powers.
  - deleted 4y ago
    [deleted]
  - ASalazarMX 4y ago
    I don't know about Google for Education, but the business flavor doesn't let you spy the email of your users, at least I haven't found it. There are ways that allow you to copy every email to an "audit" address, if you're persistent enough, but good luck managing that mess and liability. There's the option of quarantining emails that have specific keywords. That's the likely way to catch students discussing cheating, attachments and all. Edit: as the comment below has pointed out, this might not be true. Different editions have different tools, the one i use is not the most complete.
    - agentdrtran 4y ago
      You can view full email content in the investigation tool, use the APIs to download their mail via MBOX and read it there, or if you're feeling bold, just add yourself as a delegate to their inbox.
      - 4y ago
hourago 4y ago
https://european-alternatives.eu/category/email-providers https://european-alternatives.eu/category/email-providers https://european-alternatives.eu/category/cloud-computing-platforms https://european-alternatives.eu/category/cloud-computing-pl... It should be easy to replace most of the services.
- moffkalast 4y ago
  Honestly I half wish we had some kind of supergiant company on this side of the pond too, despite the drawbacks that brings at least it would guarantee some sense of digital stability. I've had my gmail account for probably more than a decade now and have never had to worry about it going amiss, meanwhile I look at this list of barely legit sounding names (aside from Proton) and wonder if any of these will be still around in a few years.
  - xphx 4y ago
    Web.de was founded in 1995 and GMX in '97. Both now belong to the gigantic German United Internet AG founded in '88 which currently has roughly 10,000 employees and EUR 5.5bn revenue.
    - hourago 4y ago
      European companies lack the self grandiose promotion that USA companies have. But I think that it is a good thing. I wish USA corporations and CEOs chilled a little.
- zamalek 4y ago
  The US is slowly bleeding its tech supremacy to EU. I guess losing manufacturing to China wasn't lesson enough.
  - 988747 4y ago
    What? No, that won't happen, at least not in the next 100 years. Europe is just too far behind, technologically.
pelasaco 4y ago
- twiss 4y ago
  Just because you happen not to have heard of them doesn't mean that they're likely to sell your data. It may be hard to imagine, but people living in Europe may trust these services more than Google and Microsoft, and may not appreciate those companies giving away their services for free in exchange for mining our data and showing us ads :)
  - pelasaco 4y ago
    You will never be sure if they are selling your data or not or if they have backdoor (intentonally or not) to law enforcement and co. From the school point of view, i can tell You,they failed miserably in supporting arabic, old mobile devices and others conditions needed in Germany. Other german players couldnt keep up with high traffic during pandemics..Google in the other hand was fine. You should just anonymize the accounts and dont use it privately. But employees or zeelots downvoting and discussing here didnt have to deal with that.I did;)
  - pelasaco 4y ago
    Btw your solution to google docs failed too. We tried many german solutions, but as the new normal in Germany, you all overpromisse and under deliver...
    - twiss 4y ago
      Yeah, probably that was too much work to take on for one person. I hope there will be a better alternative to Google Docs soon :)
      - pelasaco 4y ago
        but if there is not, why force the schools and kids to go through a set of tools that really isn't helping? It is a disservice to our community. We should be thinking how can we still use the best tool for the job but with the necessary layer of security and privacy. I privately use Protonmail and Protonvpn, but that's not about me but the educational system in Germany, having to support 10 million children. This rhetoric, IMO should go away.
jeroenhd 4y ago
[flagged]
jacquesm 4y ago
Great. Now let them get rid of the Microsoft requirement, because that's at least as bad if not worse.
- contravariant 4y ago
  Could you elaborate? What microsoft requirement?
  - jacquesm 4y ago
    Highschools demand students buy a Windows laptop, preferably some overpriced piece of crap with a few applications pre-installed from their 'preferred partner' who also happens to be a Microsoft representative. It's way beyond despicable but I'm too tired to fight it so I've caved in and bought a Windows laptop for one of my kids to use for highschool. It disgusts me that Microsoft manages to extract a tax on every kid in highschool and that schools allow themselves to be used as a part of the marketing and sales arm of a multinational company.
    - Aeolun 4y ago
      I guess I wouldn’t mind so much if they came with Windows 7, instead of Windows “Telemetry” 10.
      - ronsor 4y ago
        Microsoft backported the telemetry to Windows 7 anyway.
  - lucb1e 4y ago
    Tweakers podcast of last week I think (in Dutch so I might as well paraphrase it translated). The topic was chromebooks and how it's convenient and easy for a lot of schools > I went to buy a laptop for my son's new school last week. When I heard it was required, I was expecting some list of hardware requirements but no, the list I got had exactly one specification: Windows. Schools also do free advertising for Microsoft products, at least in all of the schools where I went to until ~5 years ago. At minimum once a year we were made aware of the fact that we could get Microsoft products like Office at steep discounts from their new online store which they were so proud of and thankful for. Benevolent microsoft letting us get used to their ecosystem for prices we could actually afford, but not free! Still gotta make that profit! Not sure why they didn't also advertise for libreoffice which, last I checked, is even cheaper and an even better protip (better compatibility if we would just not force each other to keep using the proprietary thing). I guess they just didn't feel like the libreoffice foundation was giving them free money the way that microsoft pretends to. It gets even more ironic if you realize that schools fall in the 'semi-government' category and thus it's legally required (not optional) to use open source software unless that's impossible, and if it's impossible then it needs to be documented why it's impossible. In practice, you can guess how much this law is followed. I never heard of any consequences for not following it. TL;DR: legally, there is the opposite of a microsoft requirement, except many schools require both Windows and Office in practice
nickdothutton 4y ago
Shortly after the height of the Merkel/NSA hacking scandal, when EU member states were most upset that US spying had been disclosed to their electorate (making EU politicians look weak in front of the voter). The EU kicked off an internal project to try and build a gmail replacement. Their plan was that customer number 1 would be all the educational establishments on the continent. They even got as far as checking out buildings to lease from paper manufacturers, to turn into data centres. Eventually that project went away, but I don't think we’ve seen the last of it yet.
- tmp_anon_22 4y ago
  That they tried to build their own data centers is a red flag. Not because its a bad idea, but I think you need to establish product-market fit for a software product before laying down serious hardware.
  - waych 4y ago
    Agreed, but that isn't a good way to spend a lot of taxpayer money.
  - pessimizer 4y ago
    You don't have to establish product market fit in order to provide services to your own institutions. It's a great idea to piggyback on your own needs to create services that could be expanded to the general public.
    - tmp_anon_22 4y ago
      Only if allocating resources to in-house data centers does not take away resources from the product. If you're Google sure throw a 100 people at a project that might get pivoted or axed. It won't matter. But a Government IT initiative? They have to be more efficient.
  - freedomben 4y ago
    You don't need to establish product-market fit when you have the coercive power of the state. after you build the product, you can mandate the fit.
googlryas 4y ago
We will all be able to savor the irony when Dutch schoolchildren's private info is leaked, because whatever group they're going with will have no where near the concern for security and protecting private data like Google does.
- ocdtrekkie 4y ago
  Google's entire purpose is selling private data. The fact that it retains a monopoly on the access to that data doesn't change that all the bad stuff is happening right in the first party entity.
  - dekhn 4y ago
    Google does not monetize the private data in their cloud/business services. This is a different division of the company. People claim this a lot, but even in the ad part of the company, any data exchanged with other companies is not personalized. If you have any highly specific claims about this please point to news articles in reputable journals which have not already been repudiated.
    - encryptluks2 4y ago
      I too would like to see examples. I find when people jump on the hate train and literally make things up that they usually have ulterior motives or just repeat whatever they read on 4chan.
    - malepoon 4y ago
      Even if that's true, do we really want our children to grow up with (and get used to) these services that are usually "free" for personal use but paid for by tracking people across the internet, separate division or not?
      - pelasaco 4y ago
        The assumption that the "European" solutions would be the true Paladin of the justice is historically/morally wrong. It cannot be serious and as we can see in this blog post, is just fed by companies fighting for the same market.
stjohnswarts 4y ago
Good for them. Google comes through your email to build a profile for advertising. They claim its anonymous (but unique) id, but I have my doubts.
- mh- 4y ago
  > Google comes through your email to build a profile for advertising Not on GSuite accounts.
  - malepoon 4y ago
    So the students learn to use these "free" services and then later pay with their data for their personal accounts? Even worse if you ask me.
  - kiwijamo 4y ago
    And what proof do we have to prove that? I suspect they do the same things to GSuite accounts.
    - mh- 4y ago
      The ToS.
      - Nextgrid 4y ago
        Just like Facebook and Twitter claimed they wouldn't use 2FA phone numbers for advertising and did anyway? It doesn't even have to be malicious, it can happen accidentally. If the entire company is based on advertising and privacy violations then it's hard to truly have "private" data without building an entirely separate system in parallel, otherwise you could put your data in a place you think it's private, not realizing some other component of the system will use that for ad targeting.
- randomperson_24 4y ago
  Your emails are not scanned for building an advertising profile. This rumour comes up quite often, Google has thankfully stopped doing it for a long time now. https://www.nytimes.com/2017/06/23/technology/gmail-ads.html https://www.nytimes.com/2017/06/23/technology/gmail-ads.html
tinus_hn 4y ago
Note that this not an objective report, the site is for a competing product.
lizardactivist 4y ago
I guess they're following Denmark's example. And I think the rest of Europe should follow.
martin_bech 4y ago
Same here in Denmark. After the summerbreak, no google accounts and no chromebooks.
metadat 4y ago
See also related story and discussion from 6 days ago: "Google Chromebook outlawed in Danish public schools" https://news.ycombinator.com/item?id=32142927 https://news.ycombinator.com/item?id=32142927 (77 points, 73 comments)
amatecha 4y ago
IMO, everyone should stop using Google's email and cloud due to privacy concerns.
- amelius 4y ago
  And Android.
- danpalmer 4y ago
  At my previous company we were all in on Google Cloud, mostly for technical reasons as we felt it worked better for us than AWS. When it came to whitelabelling our product for a big multinational customer, they really liked that we were hosted on GCP and not AWS because they considered Amazon a competitor and couldn't justify paying AWS as a result. Privacy concerns aside (which I believe are overblown for GCP, strong walls around customer workloads), competition concerns are big for many companies, and Amazon is out there trying to compete with almost everyone in retail and services now. I can only imagine this is going to get worse. Disclaimer, I now work at Google but not on any of this stuff, this is my personal opinion.
  - tremon 4y ago
    mostly for technical reasons as we felt [..] Are you sure that's a technical reason?
    - danpalmer 4y ago
      Perhaps bad phrasing, but roughly yes. The hosted Kubernetes offering was more standard, integrated well into the rest of the available services, few other details. It was just a more technically complete and capable product for Kubernetes hosting.
stanleychink 4y ago
yosito 4y ago
I cannot for the life of me understand why public education institutions everywhere don't use Linux and open source software. For things like writing papers and doing research, Linux is more than enough. Plus it would give students a head start into understanding how computers actually work, which is arguably the most crucial skill for students today.
- microtonal 4y ago
  For things like writing papers and doing research, Linux is more than enough. This is simply false. A lot of fields use specialized software that is only available on Windows and sometimes macOS. For instance, my wife works in neurolinguistics where most standard software for doing things like analyzing EEGs is for Windows. However, I agree that this may be true in other branches of education. E.g. in our daughter's primary school they use Chromebooks. They are used as glorified 'web terminals'. I can see why a mutable Linux distribution would be awful from a maintenance perspective, but an immutable Linux system like Fedora Silverblue would probably work as well as ChromeOS. This is also a failing of the Dutch government and the EU, leaving things to the market, rather than taking initiative and making a standardized education platform.
  - alaric410 4y ago
    My field (theoretical physics) has the opposite problem. Almost all tools support only Linux but university infrastructure and incoming students are Linux-illiterate. A Linux strategy would greatly improve the quality of education.
- jenny91 4y ago
  Because Microsoft has spent billions on lobbying and spreading FUD in every educational institution and government across the world ranging from national to local governments to convince them that Windows and Office are the only usable suite of tools. So Word documents are now the lingua franca in the office.
  - EUROCARE 4y ago

288 points by starsep 4y ago

I am a UK college governor, and have bought up the GDPR issues that have come up with Google and Microsoft recently. Whilst I do get some nonsensical response, that big tech have great security, it does feel really lainful that there is basically no alternative. I really want there to be, but there just isn't a viable alternative.

ChuckNorris89 4y ago
>I really want there to be, but there just isn't a viable alternative. There isn't? My Eastern European highschool had self hosted email since as far as I can remember hosted on some pentium PCs. The issue isn't that there's no alternative, the issue is that, schools are unable or unwilling to bother doing things themselves and instead just go with Apple, Google, Microsoft, because it's easy and almost free.
- yazzku 4y ago
  Almost free? Microsoft charges hefty licenses and basically re-sales the same product multiple times. I believe Google also charges schools and universities a hefty monthly fee for the services.
- googlryas 4y ago
  If student privacy is the concern, do you think going with something self hosted is a better idea than sticking with Google? In reality, the concern seems to be the law will not legally allow them to continue operating unless Google clarifies where the data is processed.
  - Rygian 4y ago
    Sticking with Google means students have no privacy, due to the US government being able to summarily monitor their Google data. Even if Google promises the processing happens in Europe. It's not "clarify where the data is processed" but rather "make sure it's not processed by an US-owned corp" (not to say that any other country is fine, their laws must be compatible with GDPR).
- almog 4y ago
  I guess that would work great even today for _internal_ emails, but as soon as they'll need to deliver emails to any address that's hosted behind gmail, outlook and probably other dominant players, there's a long list of configurations to make and maintain so that outgoing emails don't get bounced.
  - Aeolun 4y ago
    If I can do it, surely someone whose entire job is doing it should be able to?
    - AlchemistCamp 4y ago
      If only the world were like that.
    - fcatalan 4y ago
      My entire job was doing that for a university for a few years. You won't catch me doing it again even for 2x my current salary.
    - freeflight 4y ago
      That assumes schools have dedicated IT positions, when its very common for the school IT to be managed part-time by teachers themselves, as often there ain't enough money for a dedicated IT position.
      - Aeolun 4y ago
        I’ve never seen that tbh. Any school I’ve been at has had dedicated IT personnel. Fairly well paid too.
    - 2000UltraDeluxe 4y ago
      I, and many others do. We barely manage. Email deliverability is _hard_.
      - dijit 4y ago
- gidorah 4y ago
  Unfortunately, schools do have budget constraints, so "almost free" is very, very attractive.
ls15 4y ago
> but there just isn't a viable alternative. Why can't the state build a data center and host some Matrix, Nextcloud and Moodle instances? To me that would seem like tax money being used as intended by the taxpayer.
- jeffbee 4y ago
  This kind of response always baffles me. Choose any of the common questions people have about cloud data privacy and ask the same question about Nextcloud. For example: when I delete a file does the cloud really delete it? Now read the Nextcloud source code. All it does is unlink files, and it doesn't even do that properly because it doesn't handle errors and races. Also, it poops your private data all over the filesystem while creating thumbnails and previews. So the answer is no, absolutely not even a single iota of effort has been expended making sure deleted data is really deleted, and inside administrators will have complete and total, unaudited access to it. Switching from a cloud run by professionals to a self-hosted Nextcloud would be a massive downgrade in information privacy.
  - cmroanirgo 4y ago
    The thing is, there's no gaurantee that google nor microsoft nor apple do anything more. With products like nextcloud, at least you can see exactly what's going on. We already know google, microsoft and apple have unfettered access to your data too. With self hosting, at least I have a chance of knowing when my data's being monitored & I can choose increasingly severe security around that system. The big players can only offer promises with little to no way for us to verify the truth of any one of their statements. So, unless the big players offer e2ee as a default, it's best to assume the worst from them. With nextcloud it's far less necessary if you're rolling your own (but it supports a form of encryption anyhow)
    - jeffbee 4y ago
      > at least I have a chance of knowing when my data's being monitored C'mon really. The whole central point of this euro scaremongering is that Google will turn over your data to intelligence agencies when U.S. court orders it to do so. Now imagine that for whatever fanciful and obviously highly unlikely reason the C.I.A. wants your PDFs. You are claiming this will be visible to you, that you will be able to defend yourself against hardware supply chain attacks, attacks on the media you downloaded to install CrapNux on your servers, attacks against your NextCloud auto-updates, attacks against the whole rest of your software supply chain, social engineering attacks against your sysadmins, attacks against your hard disk drive waste stream, and all the rest of it? And you will be able to achieve this on the budget on a Dutch primary school? Look, I think it would be cool if nation-sized bureaucracies had the doctrines and practices that allowed them to be actually safer than the cloud, but as it stands they do not.
avianlyric 4y ago
Well good news! Our wonderful government has great plans to scrap GDPR and all the silly European bureaucracy slowing down business, and replace it with… checks notes …better British bureaucracy that will cost just as much, while eradicating our rights to privacy… It’s a Brexit benefit or something.
stjohnswarts 4y ago
Do GPDR rules even apply in Britain any longer given that it's split from the EU is 100% now?
- vinay427 4y ago
  As far as I can tell, yes. It was implemented in the UK (as in EU countries) by incorporating it into national law, but can be reviewed at a later date as some UK politicians have claimed to support. https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-and-the-eu-in-detail/the-uk-gdpr/ https://ico.org.uk/for-organisations/dp-at-the-end-of-the-tr...
  - M2Ys4U 4y ago
    >It was implemented in the UK (as in EU countries) by incorporating it into national law That's not how it worked. The GDPR is a regulation which means that it applies as-is in all EU member states without being incorporated in to national laws. It is only directives that need to be incorporated in to national law (a process known as "transposition"). As far as the UK goes, because the GDPR was in force at the time of Brexit it continued to apply (the same with almost all EU law), although it was amended so that it didn't reference EU institutions any more (like removing the bits that talked about the EDPB or collaboration with other EU supervisory authorities, replacing references to the Commission with the Secretary of State and other things like that).
    - vinay427 4y ago
      I believe you're mostly right, so I stand corrected; apologies for the error. However, the Data Protection Act 2018 [1] does complement and supplement the GDPR in UK national law, including certain data not covered by GDPR, and more specifically apparently "implements those parts of the GDPR which 'are to be determined by Member State law'". This was before Brexit took place, and it was later amended to reflect non-EU status at the start of 2021. [1] https://en.wikipedia.org/wiki/Data_Protection_Act_2018 https://en.wikipedia.org/wiki/Data_Protection_Act_2018
- 4y ago
sjamaan 4y ago
If self hosting is not an option, there are European mail providers, who must be GDPR compliant. The biggest one being ProtonMail.
pelasaco 4y ago
That was exactly my impression in Germany too. You can search my answer in this thread discussing my whole experience. It is depressing to see this whole argumentation as main blocker to a digital breakthrough. The funniest anecdote was one of the most zealous person against google in the set of meetings that I took place about this topic, used google maps to reach the building where we held the showcases and demos.

twiss 4y ago

I went to a Dutch high school that used Google Accounts for email, and they once caught some students "cheating" on a group project (i.e. collaborating in larger groups than they were meant to collaborate in, I guess) via email. This made me suspect that the admins could read our school email (which people also used to talk about various other stuff, which I guess was unwise). I don't know if that was actually how they found out, but it made me very conscious of email privacy (or lack thereof). Now I work at ProtonMail, so go figure.

jeffbee 4y ago
Yeah of course, gsuite administrators can access everything, and because gsuite admins are just modern-day instances of bofh-type obnoxious IT guys, there's no way you'll convince them to give up those powers.
- deleted 4y ago
  [deleted]
- ASalazarMX 4y ago
  I don't know about Google for Education, but the business flavor doesn't let you spy the email of your users, at least I haven't found it. There are ways that allow you to copy every email to an "audit" address, if you're persistent enough, but good luck managing that mess and liability. There's the option of quarantining emails that have specific keywords. That's the likely way to catch students discussing cheating, attachments and all. Edit: as the comment below has pointed out, this might not be true. Different editions have different tools, the one i use is not the most complete.
  - agentdrtran 4y ago
    You can view full email content in the investigation tool, use the APIs to download their mail via MBOX and read it there, or if you're feeling bold, just add yourself as a delegate to their inbox.
    - 4y ago

hourago 4y ago

https://european-alternatives.eu/category/email-providers https://european-alternatives.eu/category/email-providers https://european-alternatives.eu/category/cloud-computing-platforms https://european-alternatives.eu/category/cloud-computing-pl... It should be easy to replace most of the services.

moffkalast 4y ago
Honestly I half wish we had some kind of supergiant company on this side of the pond too, despite the drawbacks that brings at least it would guarantee some sense of digital stability. I've had my gmail account for probably more than a decade now and have never had to worry about it going amiss, meanwhile I look at this list of barely legit sounding names (aside from Proton) and wonder if any of these will be still around in a few years.
- xphx 4y ago
  Web.de was founded in 1995 and GMX in '97. Both now belong to the gigantic German United Internet AG founded in '88 which currently has roughly 10,000 employees and EUR 5.5bn revenue.
  - hourago 4y ago
    European companies lack the self grandiose promotion that USA companies have. But I think that it is a good thing. I wish USA corporations and CEOs chilled a little.
zamalek 4y ago
The US is slowly bleeding its tech supremacy to EU. I guess losing manufacturing to China wasn't lesson enough.
- 988747 4y ago
  What? No, that won't happen, at least not in the next 100 years. Europe is just too far behind, technologically.

pelasaco 4y ago

twiss 4y ago
Just because you happen not to have heard of them doesn't mean that they're likely to sell your data. It may be hard to imagine, but people living in Europe may trust these services more than Google and Microsoft, and may not appreciate those companies giving away their services for free in exchange for mining our data and showing us ads :)
- pelasaco 4y ago
  You will never be sure if they are selling your data or not or if they have backdoor (intentonally or not) to law enforcement and co. From the school point of view, i can tell You,they failed miserably in supporting arabic, old mobile devices and others conditions needed in Germany. Other german players couldnt keep up with high traffic during pandemics..Google in the other hand was fine. You should just anonymize the accounts and dont use it privately. But employees or zeelots downvoting and discussing here didnt have to deal with that.I did;)
- pelasaco 4y ago
  Btw your solution to google docs failed too. We tried many german solutions, but as the new normal in Germany, you all overpromisse and under deliver...
  - twiss 4y ago
    Yeah, probably that was too much work to take on for one person. I hope there will be a better alternative to Google Docs soon :)
    - pelasaco 4y ago
      but if there is not, why force the schools and kids to go through a set of tools that really isn't helping? It is a disservice to our community. We should be thinking how can we still use the best tool for the job but with the necessary layer of security and privacy. I privately use Protonmail and Protonvpn, but that's not about me but the educational system in Germany, having to support 10 million children. This rhetoric, IMO should go away.

jeroenhd 4y ago

[flagged]

jacquesm 4y ago

Great. Now let them get rid of the Microsoft requirement, because that's at least as bad if not worse.

contravariant 4y ago
Could you elaborate? What microsoft requirement?
- jacquesm 4y ago
  Highschools demand students buy a Windows laptop, preferably some overpriced piece of crap with a few applications pre-installed from their 'preferred partner' who also happens to be a Microsoft representative. It's way beyond despicable but I'm too tired to fight it so I've caved in and bought a Windows laptop for one of my kids to use for highschool. It disgusts me that Microsoft manages to extract a tax on every kid in highschool and that schools allow themselves to be used as a part of the marketing and sales arm of a multinational company.
  - Aeolun 4y ago
    I guess I wouldn’t mind so much if they came with Windows 7, instead of Windows “Telemetry” 10.
    - ronsor 4y ago
      Microsoft backported the telemetry to Windows 7 anyway.
- lucb1e 4y ago
  Tweakers podcast of last week I think (in Dutch so I might as well paraphrase it translated). The topic was chromebooks and how it's convenient and easy for a lot of schools > I went to buy a laptop for my son's new school last week. When I heard it was required, I was expecting some list of hardware requirements but no, the list I got had exactly one specification: Windows. Schools also do free advertising for Microsoft products, at least in all of the schools where I went to until ~5 years ago. At minimum once a year we were made aware of the fact that we could get Microsoft products like Office at steep discounts from their new online store which they were so proud of and thankful for. Benevolent microsoft letting us get used to their ecosystem for prices we could actually afford, but not free! Still gotta make that profit! Not sure why they didn't also advertise for libreoffice which, last I checked, is even cheaper and an even better protip (better compatibility if we would just not force each other to keep using the proprietary thing). I guess they just didn't feel like the libreoffice foundation was giving them free money the way that microsoft pretends to. It gets even more ironic if you realize that schools fall in the 'semi-government' category and thus it's legally required (not optional) to use open source software unless that's impossible, and if it's impossible then it needs to be documented why it's impossible. In practice, you can guess how much this law is followed. I never heard of any consequences for not following it. TL;DR: legally, there is the opposite of a microsoft requirement, except many schools require both Windows and Office in practice

nickdothutton 4y ago

Shortly after the height of the Merkel/NSA hacking scandal, when EU member states were most upset that US spying had been disclosed to their electorate (making EU politicians look weak in front of the voter). The EU kicked off an internal project to try and build a gmail replacement. Their plan was that customer number 1 would be all the educational establishments on the continent. They even got as far as checking out buildings to lease from paper manufacturers, to turn into data centres. Eventually that project went away, but I don't think we’ve seen the last of it yet.

tmp_anon_22 4y ago
That they tried to build their own data centers is a red flag. Not because its a bad idea, but I think you need to establish product-market fit for a software product before laying down serious hardware.
- waych 4y ago
  Agreed, but that isn't a good way to spend a lot of taxpayer money.
- pessimizer 4y ago
  You don't have to establish product market fit in order to provide services to your own institutions. It's a great idea to piggyback on your own needs to create services that could be expanded to the general public.
  - tmp_anon_22 4y ago
    Only if allocating resources to in-house data centers does not take away resources from the product. If you're Google sure throw a 100 people at a project that might get pivoted or axed. It won't matter. But a Government IT initiative? They have to be more efficient.
- freedomben 4y ago
  You don't need to establish product-market fit when you have the coercive power of the state. after you build the product, you can mandate the fit.

googlryas 4y ago

We will all be able to savor the irony when Dutch schoolchildren's private info is leaked, because whatever group they're going with will have no where near the concern for security and protecting private data like Google does.

ocdtrekkie 4y ago
Google's entire purpose is selling private data. The fact that it retains a monopoly on the access to that data doesn't change that all the bad stuff is happening right in the first party entity.
- dekhn 4y ago
  Google does not monetize the private data in their cloud/business services. This is a different division of the company. People claim this a lot, but even in the ad part of the company, any data exchanged with other companies is not personalized. If you have any highly specific claims about this please point to news articles in reputable journals which have not already been repudiated.
  - encryptluks2 4y ago
    I too would like to see examples. I find when people jump on the hate train and literally make things up that they usually have ulterior motives or just repeat whatever they read on 4chan.
  - malepoon 4y ago
    Even if that's true, do we really want our children to grow up with (and get used to) these services that are usually "free" for personal use but paid for by tracking people across the internet, separate division or not?
    - pelasaco 4y ago
      The assumption that the "European" solutions would be the true Paladin of the justice is historically/morally wrong. It cannot be serious and as we can see in this blog post, is just fed by companies fighting for the same market.

stjohnswarts 4y ago

Good for them. Google comes through your email to build a profile for advertising. They claim its anonymous (but unique) id, but I have my doubts.

mh- 4y ago
> Google comes through your email to build a profile for advertising Not on GSuite accounts.
- malepoon 4y ago
  So the students learn to use these "free" services and then later pay with their data for their personal accounts? Even worse if you ask me.
- kiwijamo 4y ago
  And what proof do we have to prove that? I suspect they do the same things to GSuite accounts.
  - mh- 4y ago
    The ToS.
    - Nextgrid 4y ago
      Just like Facebook and Twitter claimed they wouldn't use 2FA phone numbers for advertising and did anyway? It doesn't even have to be malicious, it can happen accidentally. If the entire company is based on advertising and privacy violations then it's hard to truly have "private" data without building an entirely separate system in parallel, otherwise you could put your data in a place you think it's private, not realizing some other component of the system will use that for ad targeting.
randomperson_24 4y ago
Your emails are not scanned for building an advertising profile. This rumour comes up quite often, Google has thankfully stopped doing it for a long time now. https://www.nytimes.com/2017/06/23/technology/gmail-ads.html https://www.nytimes.com/2017/06/23/technology/gmail-ads.html

tinus_hn 4y ago

Note that this not an objective report, the site is for a competing product.

lizardactivist 4y ago

I guess they're following Denmark's example. And I think the rest of Europe should follow.

martin_bech 4y ago

Same here in Denmark. After the summerbreak, no google accounts and no chromebooks.

metadat 4y ago

See also related story and discussion from 6 days ago: "Google Chromebook outlawed in Danish public schools" https://news.ycombinator.com/item?id=32142927 https://news.ycombinator.com/item?id=32142927 (77 points, 73 comments)

amatecha 4y ago

IMO, everyone should stop using Google's email and cloud due to privacy concerns.

amelius 4y ago
And Android.
danpalmer 4y ago
At my previous company we were all in on Google Cloud, mostly for technical reasons as we felt it worked better for us than AWS. When it came to whitelabelling our product for a big multinational customer, they really liked that we were hosted on GCP and not AWS because they considered Amazon a competitor and couldn't justify paying AWS as a result. Privacy concerns aside (which I believe are overblown for GCP, strong walls around customer workloads), competition concerns are big for many companies, and Amazon is out there trying to compete with almost everyone in retail and services now. I can only imagine this is going to get worse. Disclaimer, I now work at Google but not on any of this stuff, this is my personal opinion.
- tremon 4y ago
  mostly for technical reasons as we felt [..] Are you sure that's a technical reason?
  - danpalmer 4y ago
    Perhaps bad phrasing, but roughly yes. The hosted Kubernetes offering was more standard, integrated well into the rest of the available services, few other details. It was just a more technically complete and capable product for Kubernetes hosting.

stanleychink 4y ago

yosito 4y ago

I cannot for the life of me understand why public education institutions everywhere don't use Linux and open source software. For things like writing papers and doing research, Linux is more than enough. Plus it would give students a head start into understanding how computers actually work, which is arguably the most crucial skill for students today.

microtonal 4y ago
For things like writing papers and doing research, Linux is more than enough. This is simply false. A lot of fields use specialized software that is only available on Windows and sometimes macOS. For instance, my wife works in neurolinguistics where most standard software for doing things like analyzing EEGs is for Windows. However, I agree that this may be true in other branches of education. E.g. in our daughter's primary school they use Chromebooks. They are used as glorified 'web terminals'. I can see why a mutable Linux distribution would be awful from a maintenance perspective, but an immutable Linux system like Fedora Silverblue would probably work as well as ChromeOS. This is also a failing of the Dutch government and the EU, leaving things to the market, rather than taking initiative and making a standardized education platform.
- alaric410 4y ago
  My field (theoretical physics) has the opposite problem. Almost all tools support only Linux but university infrastructure and incoming students are Linux-illiterate. A Linux strategy would greatly improve the quality of education.
jenny91 4y ago
Because Microsoft has spent billions on lobbying and spreading FUD in every educational institution and government across the world ranging from national to local governments to convince them that Windows and Office are the only usable suite of tools. So Word documents are now the lingua franca in the office.
- EUROCARE 4y ago