According to the Dutch Personal Data Authority (Autoriteit Persoonsgegevens, AP), Google’s email and cloud services do not comply with European privacy legislation. The AP says that universities, including the UG, should therefore stop using Google’s services.
This according to newspaper Het Financieele Dagblad (FD), which was given access to two confidential advisory reports of the Dutch data protection authority. According to the FD, the AP is ‘unusually vicious towards the American software company’.
Privacy compromised
‘According to the AP, one big issue is that educational institutes don’t know how and where personal data about their pupils and students are processed, for what purpose, and on what basis’, writes the FD. Therefore the authority says this processing cannot take place lawfully, the newspaper writes.
The UG is one of the universities that uses Google’s mail and cloud services such as Gmail, Meet, Docs, and Classroom. ‘The problem is that our emails, shared documents and calendar appointments now all end up somewhere at Google without us knowing what exactly is happening to them’, says Jaap-Henk Hoepman, associate professor of IT law.
Taking back control
This skepticism about Google has been widely supported for some time, says Hoepman. Now that this has been confirmed by the AP, the university should take note. ‘You have to get rid of Google, that much is clear. And this is a good opportunity to do it right. To stand up for the public cause and not go for a Google-like solution again.’
By this, Hoepman means that the university should not hand over control of the primary processes, such as email and document sharing, to a large tech company in America again, but keep matters in their own hand. ‘Use your own software and your own servers, so you know where the information is and what happens to it.’
According to Hoepman, the university already has the necessary resources to make its own email servers and file sharing via local disks simple and fast. But, he also says, scalable alternatives to services such as Docs and Sheets do not exist yet. ‘You can switch to Microsoft. They do have a slightly better privacy policy, but you’re still dependent on them. I wouldn’t recommend that.’
Developing your own solutions
According to him, the best alternative is to cooperate with other public institutions via a network such as Public Spaces. ‘The Dutch public broadcasting system uses that, too,’ he says. And SURF, the cooperative association of Dutch educational institutions to which the UG belongs, also develops digital services.
‘We should talk with those associations and seize the opportunity to develop a good alternative together. Show that, as public institutions, we stand for public interests.’
Responsibility of Google
It seems that the university will not be taking responsibility for the data itself any time soon, though, but wants to leave it with Google.
‘This is now being taken up by the Association of Dutch Universities (VSNU), together with other umbrella educational organisations’, says UG spokesperson Anja Hulshof. ‘Together, they want to appeal to Google’s social responsibility to solve the problems, so that our staff and students can use the products safely.’