5 ms·

Its not true. I only have a correct source in danish: https://www.berlingske.dk/samfund/et-centralt-vaerktoej-for-skoleelever-blev-udraabt-som-forbudt-i-hele ht

by msh 4y ago

Its not true. I only have a correct source in danish: https://www.berlingske.dk/samfund/et-centralt-vaerktoej-for-skoleelever-blev-udraabt-som-forbudt-i-hele https://www.berlingske.dk/samfund/et-centralt-vaerktoej-for-... But only one local county have been forbidden from processing personal data on school chromebooks as they did not do any analysis of the consequences.

oefrha 4y ago
Actual statement: https://www-datatilsynet-dk.translate.goog/afgoerelser/afgoerelser/2022/jul/datatilsynet-nedlaegger-behandlingsforbud-i-chromebook-sag-?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://www-datatilsynet-dk.translate.goog/afgoerelser/afgoe... Title seems dramatized, not surprising when it’s a blog post from a competitor eager to sell a replacement to said schools. Probably should switch to a better source.
aliceryhl 4y ago
Google has a blog post that says the same thing: https://cloud.google.com/blog/products/identity-security/google-cloud-eu-education-data-transfer-protections-privacy-assessment https://cloud.google.com/blog/products/identity-security/goo...
- rattray 4y ago
  Excerpt of summary paragraph for the lazy: > Recently, Datatilsynet (the Danish Data Protection Authority) issued a ruling emphasizing the importance of conducting proper due diligence before implementing cloud services. We agree due diligence is an important step for customers since privacy assessments and outcomes can vary significantly based on the way customers have configured their system. Although this ruling is limited to Helsingør Municipality, it may be of interest to other Danish controllers. To be clear, the ruling does not apply to Google directly or to other customers, nor does it prohibit use of Google Workspace for Education or Chromebooks in Denmark.
goto11 4y ago
The ruling is "the first in a series of cases regarding the use of Chromebooks and the G-suite for education". So likely this is just the beginning. There have been two rulings regarding this particular municipality. First, they were investigated due to a data breach (personally-identifiable information was shared between G-suite and Youtube). This breach lead Datatilsynet (the Danish Data Protection Agency) to investigate the municipality and conclude they hadn't done their due diligence in investigating privacy implication of the setup. This forced the municipality to perform a through investigation of the privacy issues. Their findings in turn lead Datatilsynet to ban further use of G-suite an Chromebooks (in the municipality) because they found more serious issues, for example they couldn't guarantee private information was not shared with unsafe countries. The choice of software and hardware is decided by each municipality, so there will be no nationwide ban as such. But underlying privacy problems will be the same for other municipalities which use the same software.
- msh 4y ago
  But that was due to misconfiguration. For example the kids could access and comment on youtube videos with their school accounts and when it did that the comments was posted with their full name and school/class name.
  - easrng 4y ago
    Oh, so that's why Youtube doesn't show comments on my school account anymore. Makes sense I guess.
  - goto11 4y ago
    That misconfiguration is what triggered the investigation, but the investigation uncovered more severe problems, for example the municipality could not guarantee that private information was not transferred to unsafe countries. Google have some setup where the data is stored in the EU (Ireland) and allegedly the encryption key is only available to the Ireland branch of Google and not the US branch. But the setup is still accessed by personnel from the US branch.
spookie 4y ago
If it isn't, it should be. School is obligatory, we really shouldn't employ commercial products in schools to begin with. In Portugal, some years ago, kids were given computers with a Linux distro pre-installed for *free*, and LibreOffice was used as a word processor replacement. Argentina did the same thing, hell there were others too.
- ymolodtsov 4y ago
  So kids now have to learn bad products like LibreOffice they will use in their life? Fantastic.
  - spookie 4y ago
    What's so bad about LibreOffice? If they want they want, they can use another word processor out of their own volition, the problem here is Word being the default.
- msh 4y ago
  So no books then? Most of them are published commercially.
  - rekrsiv 4y ago
    Physical volumes are still easier to secure than computer systems. They might trust the physical copies more.
  - Schroedingersat 4y ago
    Textbooks should really be public domain. They're paid for by public money anyway, it's just we currently also pay 10x the cost to make them directly to elsevier or pearson.
    - EUROCARE 4y ago
      What do you mean, they're paid for by public money? I don't think that's true at all - at least in EU. Some of them get public donations (to support the independence of the authors, usually), and some of them are written by people paid by a university, but there's so much more completely independently funded textbooks...
2000UltraDeluxe 4y ago
Elsinore's mayor seems to be of a different opinion: https://www.linkedin.com/posts/benediktekiaerhelsingor_education-data-google-activity-6954728422744969216-3iLB https://www.linkedin.com/posts/benediktekiaerhelsingor_educa... (in Danish) Long story short, she claims this will have far-reaching consequences not just for Elsinore, but for other school districs as well. Elsinore did, indeed, do an analysis, which is clearly stated in the report: https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jul/datatilsynet-nedlaegger-behandlingsforbud-i-chromebook-sag- https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jul... (also in Danish -- translator link in a sibling comment) The main points are that Elsinore concluded that the risks with using Google Workspace are low, but that it cannot be guaranteed that US authorities won't be able to get hold of the data. In order to be allowed to use Google Workspace, Elsinore must re-evaluate that position and be absolutely sure that such leaks cannot happen. This is the part that might have far-reaching consequences, since Elsinore -- and many others -- don't see that as possible. I'm in no way an expert when it comes to GDPR, but there's a lot of people who're quite upset about this, since it means any school using Google Workspace is expected to prove data transfer to non-EU entities isn't possible without adequate protection.
- throwaway4good 4y ago
  I think the mayor is correct. GDPR is EU law. And unless some super lawyer shows up from Helsingørs kommune or more likely from Google then this goes not only for Denmark but the rest of the EU as well. Normally a seller of a piece of software to an institution would provide the documentation, if nedeed, that the piece of software follows GDPR. Now with Google, Helsingør likely gets the software for free. And Google takes the data and use it for targeting advertisement and maybe other things. Personally I think the school system in Denmark should only use suppliers with a straight-forward pay and use business model. Much in the same way I don't think our children's text books should contain advertisement or be sponsored by business or political interests.

by msh 4y ago

oefrha 4y ago

Actual statement: https://www-datatilsynet-dk.translate.goog/afgoerelser/afgoerelser/2022/jul/datatilsynet-nedlaegger-behandlingsforbud-i-chromebook-sag-?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://www-datatilsynet-dk.translate.goog/afgoerelser/afgoe... Title seems dramatized, not surprising when it’s a blog post from a competitor eager to sell a replacement to said schools. Probably should switch to a better source.

aliceryhl 4y ago

Google has a blog post that says the same thing: https://cloud.google.com/blog/products/identity-security/google-cloud-eu-education-data-transfer-protections-privacy-assessment https://cloud.google.com/blog/products/identity-security/goo...

rattray 4y ago
Excerpt of summary paragraph for the lazy: > Recently, Datatilsynet (the Danish Data Protection Authority) issued a ruling emphasizing the importance of conducting proper due diligence before implementing cloud services. We agree due diligence is an important step for customers since privacy assessments and outcomes can vary significantly based on the way customers have configured their system. Although this ruling is limited to Helsingør Municipality, it may be of interest to other Danish controllers. To be clear, the ruling does not apply to Google directly or to other customers, nor does it prohibit use of Google Workspace for Education or Chromebooks in Denmark.

goto11 4y ago

The ruling is "the first in a series of cases regarding the use of Chromebooks and the G-suite for education". So likely this is just the beginning. There have been two rulings regarding this particular municipality. First, they were investigated due to a data breach (personally-identifiable information was shared between G-suite and Youtube). This breach lead Datatilsynet (the Danish Data Protection Agency) to investigate the municipality and conclude they hadn't done their due diligence in investigating privacy implication of the setup. This forced the municipality to perform a through investigation of the privacy issues. Their findings in turn lead Datatilsynet to ban further use of G-suite an Chromebooks (in the municipality) because they found more serious issues, for example they couldn't guarantee private information was not shared with unsafe countries. The choice of software and hardware is decided by each municipality, so there will be no nationwide ban as such. But underlying privacy problems will be the same for other municipalities which use the same software.

msh 4y ago
But that was due to misconfiguration. For example the kids could access and comment on youtube videos with their school accounts and when it did that the comments was posted with their full name and school/class name.
- easrng 4y ago
  Oh, so that's why Youtube doesn't show comments on my school account anymore. Makes sense I guess.
- goto11 4y ago
  That misconfiguration is what triggered the investigation, but the investigation uncovered more severe problems, for example the municipality could not guarantee that private information was not transferred to unsafe countries. Google have some setup where the data is stored in the EU (Ireland) and allegedly the encryption key is only available to the Ireland branch of Google and not the US branch. But the setup is still accessed by personnel from the US branch.

spookie 4y ago

If it isn't, it should be. School is obligatory, we really shouldn't employ commercial products in schools to begin with. In Portugal, some years ago, kids were given computers with a Linux distro pre-installed for *free*, and LibreOffice was used as a word processor replacement. Argentina did the same thing, hell there were others too.

ymolodtsov 4y ago
So kids now have to learn bad products like LibreOffice they will use in their life? Fantastic.
- spookie 4y ago
  What's so bad about LibreOffice? If they want they want, they can use another word processor out of their own volition, the problem here is Word being the default.
msh 4y ago
So no books then? Most of them are published commercially.
- rekrsiv 4y ago
  Physical volumes are still easier to secure than computer systems. They might trust the physical copies more.
- Schroedingersat 4y ago
  Textbooks should really be public domain. They're paid for by public money anyway, it's just we currently also pay 10x the cost to make them directly to elsevier or pearson.
  - EUROCARE 4y ago
    What do you mean, they're paid for by public money? I don't think that's true at all - at least in EU. Some of them get public donations (to support the independence of the authors, usually), and some of them are written by people paid by a university, but there's so much more completely independently funded textbooks...

2000UltraDeluxe 4y ago

Elsinore's mayor seems to be of a different opinion: https://www.linkedin.com/posts/benediktekiaerhelsingor_education-data-google-activity-6954728422744969216-3iLB https://www.linkedin.com/posts/benediktekiaerhelsingor_educa... (in Danish) Long story short, she claims this will have far-reaching consequences not just for Elsinore, but for other school districs as well. Elsinore did, indeed, do an analysis, which is clearly stated in the report: https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jul/datatilsynet-nedlaegger-behandlingsforbud-i-chromebook-sag- https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jul... (also in Danish -- translator link in a sibling comment) The main points are that Elsinore concluded that the risks with using Google Workspace are low, but that it cannot be guaranteed that US authorities won't be able to get hold of the data. In order to be allowed to use Google Workspace, Elsinore must re-evaluate that position and be absolutely sure that such leaks cannot happen. This is the part that might have far-reaching consequences, since Elsinore -- and many others -- don't see that as possible. I'm in no way an expert when it comes to GDPR, but there's a lot of people who're quite upset about this, since it means any school using Google Workspace is expected to prove data transfer to non-EU entities isn't possible without adequate protection.

throwaway4good 4y ago
I think the mayor is correct. GDPR is EU law. And unless some super lawyer shows up from Helsingørs kommune or more likely from Google then this goes not only for Denmark but the rest of the EU as well. Normally a seller of a piece of software to an institution would provide the documentation, if nedeed, that the piece of software follows GDPR. Now with Google, Helsingør likely gets the software for free. And Google takes the data and use it for targeting advertisement and maybe other things. Personally I think the school system in Denmark should only use suppliers with a straight-forward pay and use business model. Much in the same way I don't think our children's text books should contain advertisement or be sponsored by business or political interests.