The Council of Transparency and Data Protection of Andalusia has imposed six sanctions, two of them very serious, on the Ministry of Education for the alleged transfer of personal data of students and teachers to Google within the framework of the educational agreement signed in 2020 and still in force. More than 738,000 students and 43,200 teachers from 2,676 Andalusian educational centers have been affected by the use of the Google Workspace for Education platform
Repeated breaches in data protection
Resolution RPS-2024/074 of the Transparency Council concludes that the Ministry of Education repeatedly breached the General Data Protection Regulation in the implementation and use of the digital platform. The Council received several complaints between 2022 and 2023, from both teachers and families, which warned about irregularities in the agreement with Google Ireland Limited.
According to the agency, the activation of the service was carried out in a generalized and automatic manner based on the data stored in the Seneca system, without prior notification to those affected or assessment of the associated risks. The Council considers that infringements of the principles of lawfulness, loyalty and transparency, as well as purpose limitation, data minimization and proactive responsibility, have been proven
Deficiencies in management and risks for sensitive data
The Council's analysis detects deficiencies in the fulfillment of the duty to inform, in the definition of the legal basis for processing, and in the adoption of data protection measures by design and by default. The absence of a prior data protection impact assessment before signing the agreement is highlighted, despite it being a massive and systematic processing involving minors.
The Ministry of Education acknowledged that the impact assessment was not carried out before the service was launched, and that it was only in the drafting phase after the first complaints. The Council warns of the risk of processing special categories of personal data, such as information on health, religion, or educational orientation, which could occur through the ordinary use of digital tools by teachersIn addition, the Council points out the lack of clear protocols and effective control mechanisms to prevent improper processing of special data. It also warns of the lack of specificity regarding the location of servers and the recipient countries of the data, as well as the use of outdated contractual clauses during part of the agreement's validity
Corrective measures and demand for political explanations
The Transparency Council has not imposed an economic sanction, but it declares the commission of several administrative infractions and agrees to the imposition of corrective measures. Among them, **to adapt the processing to the regulations, to reinforce the information to those affected, to complete the impact assessment and to review the content of the agreement and its annexes**
"Clear and detailed explanations for the transfer of student data" - Patricia Alba, Secretary of Education for PSOE-A
Patricia Alba, secretary of Education of PSOE-A, has demanded explanations on how an agreement was authorized that has allowed minors' data to end up on servers outside the European Union, without impact assessments or informed consent from families, as required by European regulations.
"Battery of initiatives to ask for explanations from the Board about the transfer of data of thousands of students" - Antonio Maíllo, federal coordinator of Izquierda Unida and candidate for Por Andalucía
For his part, Antonio Maíllo, federal coordinator of Izquierda Unida and candidate for Por Andalucía, has announced the registration of parliamentary initiatives to ask the Junta for explanations on the management of students' personal data
Response of the Department and action plan
The Ministry of Education rejects that the data of students and teachers have been ceded to Google and maintains that the Council has only pointed out the need to establish clearer measures for information and teacher training. The Junta de Andalucía has developed an action plan to respond to the requirements of the Council of Transparency and Data ProtectionAccording to the Board, the Council considered it necessary to establish clearer measures on teacher training and user information on account creation and the explanation of data processing, an issue that has been addressed through the ongoing Action Plan