The Council for Transparency and Data Protection of Andalusia has demanded that the Andalusian Government reinforce the guarantees in the management of personal data of 738,502 students, 43,202 teachers, and 2,676 schools that Google currently manages through the Workplace for Education platform. During the last five years, the regional administration has received six sanctions for violating the European General Data Protection Regulation (GDPR) in the processing of student and teacher information.
The Transparency Council detects deficiencies and demands changes
On February 10, the Transparency Council issued a report after analyzing the data transfer to Google. The document concludes that the Ministry of Educational Development and Vocational Training must correct substantive aspects of data protection. The report highlights that the impact assessment carried out is a step forward, but warns that it is insufficient to guarantee the necessary rigor in a system that affects more than one million users, mostly minors.
"The impact assessment constitutes a significant advance in compliance with the obligations arising from the European regulation and the corrective measures imposed (…) The document constitutes a necessary, but not sufficient, starting point. It requires to be completed and deepened in the indicated aspects to achieve the rigor corresponding to a treatment that affects more than one million potential users, mostly minors, within the scope of the Andalusian public education system". - Data Protection Report
Sanctions and international transfers under investigation
Among the six sanctions imposed, two have been classified as very serious. One of them refers to the transfer of student data to countries such as Singapore, El Salvador, or the Philippines, which did not comply with the GDPR. Currently, the Transparency Council considers that the data transfers comply with the regulations, relying on a Google document that ensures that information movements to the United States and third countries are carried out under the Data Privacy Framework.
"As the personal data belongs to the Ministry, it is absolutely illegible by Google and the account patterns are absolutely anonymized." - Spokesperson, Ministry of Educational Development and Vocational Training
New agreement and political debate
The Andalusian Government is preparing a new agreement with Google that will be signed in November, with the objective of complying with the law and avoiding new sanctions. The initial agreement was signed in 2020 by the minister Carmen Castillo and an addendum in 2024 foresees its update before the end of the year.
The political opposition has described the case as a "scandal" and has requested the termination of the agreement, an internal audit, and the assumption of political responsibilities by the councilor.
Concern among experts and faculty
Rafael Rodríguez, professor of Philosophy of Law at Pablo de Olavide University, warns about the risks of trusting data protection in a changing legal context between the European Union and the United States.
"In a changing legal context, in which transatlantic relations between the EU and the US are not at their best, it is striking that these risks are being taken. It cannot be ignored that there is a conflict between the current US administration and the EU regarding European regulations on the internet. In fact, a very high risk is recognized and yet, a rather touching confidence in Google's goodness is displayed." - Rafael Rodríguez, Pablo de Olavide University
Rodríguez also criticizes the overload of tasks for the teaching staff, who must assume competencies in data protection in addition to their usual functions. Mario de la Peña, a member of the children's commission in the Professional Association of Privacy and Artificial Intelligence, points out that the Administration has not adequately regulated the use of Google and warns about the possible use of disaggregated data to segment minors by interests and ages.
Use of platforms and privacy warnings
At least one Andalusian center has stored evaluation records in Google Drive, although the Junta establishes that the official platform for this purpose is Séneca. The provincial educational inspection did not detect any infraction in that specific case. However, the Ministry insists that Séneca is the only authorized way for the management of school records.
A professor, who prefers to remain anonymous, warns about the long-term consequences of processing students' sensitive data.
"Nobody realizes that that student who isn't doing gymnastics today because he has a heart murmur, in 10 years will want to get insurance and won't be able to because the insurer will know his heart isn't working well." - Anonymous professor
The Ministry defends protection and training
The Minister of Education, Carmen Castillo, has defended in the regional Parliament that there has never been a breach in the personal data protection of Andalusian students and teachers. According to Castillo, the Transparency Council has only requested that families and teachers be informed and trained to avoid risks, and that current guarantees are sufficient.
"There has never been a breach in the personal data protection of Andalusian students and teachers (...) The only thing the Transparency Council has asked us is to inform and train families and teachers to avoid risks. What the Council detected was an infraction because we did not seem to have sufficient guarantees to protect the data, not that there was a breach. And on February 10, it told us that we have those guarantees and our data is protected." - Carmen Castillo, Minister of Education
The European Union has imposed three fines on Google for abuse of dominant position totaling 8.257 billion euros. The debate on data protection in the Andalusian educational sphere remains open, pending the signing of the new agreement and the response to political and social demands.