DPIA Google G Suite Enterprise for SLM Rijk | 9 July 2020, with update 12 February 2021
6.
Interests in the data processing This section outlines the different interests of Google and Dutch government organisations in the use of G Suite Enterprise. The interests of the Dutch government organisations may align with the interests of their employees, but this is not always the case. This section does not include an analysis of the fundamental data protection rights and interests of employees as data subjects. How their rights relate to the interests of Google and the Dutch government organisations is analysed in part B of this DPIA.
6.1
Interests of the Dutch government organisations Dutch government organisations have security, efficiency and compliance reasons to use cloud productivity software such as G Suite Enterprise. The G Suite Enterprise services offer functionality that allow end users to jointly and simultaneously access and work on files and documents that are stored in Google’s cloud. The use of a cloud environment makes it easier for end users to share information with each other instead of distributing copies, such as attachments to an email. Similarly, file sharing is easier and safer with Drive. Many organisations still share files via network drives for document storage or via local storage servers. In practice, employees increasingly share information via consumer versions of cloud products because existing solutions with network drives and local storage are not sufficient. Many people use, for example, Dropbox or WeTransfer to share files. This can result in a parallel network that the government organisations cannot manage. It is a well-known IT problem to properly organise and manage the access authorisations for the network drives. If end users have access to documentation to which they should not have access based on their role, this results in multiple security and privacy risks. In contrast to the network drives, Google offers transparency and controls about the rights that have been granted for access to the information with a number of features such as the Google Drive Access checker, Data Loss Prevention, Access Transparency, G Suite Security Center, Admin Audit and Reports, and Shared Drives. These tools also allow end users or admins, depending on the application, to see who has access to what information. Government organisations also have a strong interest in providing reliable, always working, well integrated and location independent productivity tools to their employees. Well-functioning for the Dutch government also means that the software has to be accessible on different kinds of devices, and from different locations. The ability for employees to seamlessly work at home through for example collaboration tools like Google+, Groups for Business and Hangout, is more urgent than ever since the outbreak of the COVID-19 pandemic. The use of the webbased G Suite services may allow government organisations to cut back spending on the maintenance of desktops in offices, and potentially switch to the use of Chromebooks. Because G Suite is widely used by consumers, government employees may also require less IT support because they are already accustomed with the G Suite services Additionally, the ability to access log data about end user behaviour through the many different audit logs in G Suite Enterprise is essential for government organisations to comply with their own obligations as data controllers to detect security incidents. By using log files such as the Drive and the Login audit logs the administrators can access data about end users' sign-in attempts and access to personal data in files stored in Drive. This information is necessary to detect and mitigate possible security incidents and data breaches.
p. 91/162
