Denmark: Issued Data Protection Agency assessment on compliance with order on Google Workspace Usage in Danish Schools

On 10 July 2024, the Danish Data Protection Agency issued an assessment to municipalities regarding the use of Google Workspace in primary and lower secondary schools, confirming that municipalities are compliant with the Agency's January 2024 order and have ceased the unauthorised passing of personal data. KL, representing 52 municipalities, stated that from 1 August 2024, personal data would no longer be shared for Google's purposes, addressing the Agency's concerns. The Agency noted that contract adjustments ensure personal data will be processed only according to the municipality's instructions, except when required by applicable law. The Agency has sought an opinion from the European Data Protection Board on the data controller's documentation obligations for sub-processors and will finalise its assessment of Google's product use in municipalities once the opinion is received.