Rewrite your Google contracts or stop using Apps, Swedish schools told
Sweden's data protection authority has ordered a municipality in Stockholm to stop using Google Apps in schools due to inadequacies in its contract with the company.
Sweden's schools face new uncertainty over their use of Google Apps and other cloud services for collaboration, email, calendar and storage after the country's Data Inspection Board last week ordered the Sollentuna Kommun municipality to suspend its use of Apps unless it can draw up a contract with Google that better complies with data protection legislation.
According to the board, the municipality's contract with Google didn't comply with Sweden's Data Protection Act, leaving the municipality with a choice of urgently signing an appropriate agreement or ceasing to process personal data in the cloud.
"We understand they can't stop [using Google Apps] immediately, but they have to choose a path," Ingela Alverfors, a lawyer for the Data Inspection Board, told ZDNet.
Under Sweden's Data Protection Act, anyone that uses cloud services nevertheless remains the 'controller' of any personal data they process, and should therefore set rules for cloud providers concerning data retention and any limitations on usage of that data.
The other issue that has cropped up elsewhere in Europe is the need for organisations to ensure that when customers' data is transferred to other countries, those countries comply with the Personal Data Act and other legislation.
The municipality's contract with Google lacked the provisions needed to lock down its data in accordance with Swedish law, the Data Inspection Board said, and also did not stipulate what security measures Google must take to protect the personal data it processes for the municipality.
Although the ruling only applies to schools within the Sollentuna Kommun municipality, it could have an impact on schools in other areas too since, as the authority notes in its decision, there is a tendency in the education sector to accept the terms offered by the service provider in the contract whether or not they comply with local law.
"I would say its a bigger question than just Sollentuna," Alverfors said.
Sollentuna Kommun, which began rolling out Google Apps to schools in 2009, now has two weeks to appeal against the decision, but according to Alverfors the municipality has so far not responded to the order.
Abandoning Google Apps could be a painful process if it gets that far. Besides using the tools such as Drive, Sites and Gmail for collaboration and communication, in some cases it has become compulsory for students to sign-up to Google Apps in order to access teaching materials.
ZDNet contacted Sollentuna Kommun and Google's Swedish offices for responses to the decision and will update the story when it receives them.
The decision on Sollentuna follows a similar one it made over Salem municipality's use of Google Apps earlier this year, but that decision is currently being appealed against.