DPIA Google G Suite Enterprise for SLM Rijk | 9 July 2020, with update 12 February 2021
• • • • • • • •
Sending limited anonymous information about web forms to improve Autofill; Process payment information and share with Google Pay; Customize your language based on the languages of sites you visit; Send usage statistics and crash reports to Google; Share aggregated, non-personally identifiable information publicly and with partners – like publishers, advertisers or web developers; Send a unique Adobe Flash identifier to content partners and websites that use Adobe Flash Access; Provide access to Additional Services such as Google Translate Install three kinds of unique identifiers and use these for: Installation tracking; Tracking of promotional campaigns; Field trials.
The Chrome privacy notice contains specific explanations about the processing of Diagnostic Data; for the purposes of Usage Statics and crash reports and Server Log Privacy Information. Google explains that Chrome OS and the Chrome browser usage statistics contain information such as preferences, button clicks, performance statistics, and memory usage. Usage data may also include web page URLs or personal data, if the setting is enabled: "Make searches and browsing better / Sends URLs of pages you visit to Google."188 As shown in Figure 25, this option is disabled by default in the tested Chrome browser. Additionally, Google explains: “If Google Play apps are enabled on your Chromebook and Chrome usage statistics are enabled, then Android diagnostic and usage data is also sent to Google.”189 As shown in Figure 25 the sending of usage statistics is enabled by default.
5.
Processor or (joint) controller This section assesses the data protection role of Google and government organisations in the context of the G Suite Enterprise services.
5.1
Definitions The GDPR contains definitions of the different roles of parties involved in processing data: (joint) controller, processor and subprocessor. Article 4(7) of the GDPR defines the (joint) controller as: "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.” Article 26 of the GDPR stipulates that where two or more data controllers jointly determine the purposes and means of a processing, they are joint controllers. Joint controllers must determine their respective responsibilities for compliance with obligations under the GDPR in a transparent manner, especially towards data subjects, in an arrangement between them. Google Chrome help, Start or stop automatically reporting errors and crashes, https://support.google.com/chrome/answer/96817 On desktops, this option can be found in the Chrome settings You and Google, ‘Sync and Google Services’. 189 Google Chrome Privacy Notice, Section Usage statistics and crash reports. 188
p. 79/162
