DPIA Google G Suite Enterprise for SLM Rijk | 9 July 2020, with update 12 February 2021
for personal data that falls within the scope of the G Suite DPA, but not as an independent data controller.
5.3
Data controller Given the limitation of the scope of the G Suite DPA to personal data in Customer Data from the Core Services, and Google’s explanation that this also applies to the Google Account when used in conjunction with Core Services and the Features, Google qualifies itself as a data controller for the processing of personal data in the Google Account when used outside of the Core Services, the Additional Services, Other related services such as Feedback and for all Diagnostic Data.
5.3.1
Google Account As explained in Section 1.2, government employees must create a Google Account if they want to use the G Suite Enterprise services. When end users create their account, they have to accept the (consumer) Terms of Service and the (consumer) Privacy Policy. See Figure 6. Google distinguishes between the use of the Google Account in the Core Services, and the use of the account in other (consumer) services, as detailed in Section 1.4.2. However, this technical distinction is not yet contractually guaranteed. For end users the operational difference between the enterprise and the consumer environment may be hard to discern. This is the case, for example, when end users want to use a spellingchecker in Google Docs. If an employee uses a Chrome browser, there are three kinds of spellcheckers available, while only the Feature Spelling and grammar falls within the scope of the G Suite DPA. Google qualifies itself as data controller for the Google Account that can be used for any of the 92 different consumer services. Unless Google provides contractual assurances about the purposes for which it can process the Google Account in the Core Services, and allows admins of government organisations access to all data collected about the use of the Google Account in the Core Services, Google factually qualifies as data controller in both enterprise and consumer environments, but not as independent controller. This will be explained further in Section 5.4 below.
5.3.2
Diagnostic Data To provide secure, well-functioning, bug free and up to date services, the processing of some Diagnostic Data about the individual use of the services may be necessary. In order to achieve such clear objectives, the data processor has a certain liberty to decide how the personal data are processed and in which systems (with which means). However, the processor must be transparent about what personal data it needs to process, and for what purposes, in order to successfully claim to act on instructions of the controller. In the G Suite DPA Google does not mention the Diagnostic Data at all. Diagnostic Data is therefore not covered by the G Suite DPA and Google is not a data processor when it processes Diagnostic Data. In Section 4.2.2, ten purposes have been identified for which Google processes the Diagnostic Data relating to the use of the Core Services. These purposes have been identified in discussions with Google during the course of this DPIA. Two of these ten identified purposes are so broad that the government organisations cannot determine what types of processing are in, or outside the scope of these purposes. These are:
p. 82/162
