Introduction

This report is commissioned by the Microsoft Strategic Vendor Management office (SLM Rijk1) of the Ministry of Justice and Security. This is the first DPIA report from the Dutch government about G Suite Enterprise.

Previously, SLM Rijk commissioned and published impact assessments about different Microsoft Office 365 and Windows 10 products and services.2 The full reports with appendices are available in English, with a short summary in Dutch. The DPIA reports have been written by the Dutch privacy consultancy firm Privacy Company.3

DPIA

Under the terms of the General Data Protection Regulation (GDPR), an organisation is obliged to carry out a data protection impact assessment (DPIA) under certain circumstances, for instance where it involves large-scale processing of personal data. The assessment is intended to shed light on, among other things, the specific processing activities, the inherent risk to data subjects, and the safeguards applied to mitigate these risks. The purpose of a DPIA is to ensure that any risks attached to the process in question are mapped and assessed, and that adequate safeguards have been implemented to mitigate those risks.

A DPIA used to be called PIA, privacy impact assessment. According to the GDPR a DPIA assesses the risks for the rights and freedoms of individuals. Data subjects have a fundamental right to protection of their personal data and some other fundamental freedoms that can be affected by the processing of personal data, such as for example freedom of expression.

The right to data protection is therefore broader than the right to privacy. Recital 4 of the GDPR explains: “This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity”.

This DPIA follows the structure of the DPIA Model mandatory for all Dutch government organisations.4

Umbrella DPIA versus individual DPIAs

Currently, most of the approximately 300.000 employees and workers in the Dutch ministries, parliament, the High Councils of state, the advisory commissions, the police, the fire department and the judiciary, as well as the independent administrative authorities use Microsoft Office 365 software.5 The Google G Suite Enterprise services could be a relevant alternative for Office 365, if the outcome of the DPIA is that there are no residual high risks for data subjects whose data are processed through G Suite Enterprise.

1 SLM is the abbreviation of the Dutch words Strategisch Leveranciersmanagement Microsoft. 2 URL: https://slmmicrosoftrijk.nl/ 3 https://www.privacycompany.eu/ 4 Model Gegevensbeschermingseffectbeoordeling Rijksdienst (PIA) (September 2017). For an explanation and examples (in Dutch) see: https://www.rijksoverheid.nl/documenten/rapporten/2017/09/29/modelgegevensbeschermingseffectbeoordeling-rijksdienst-pia. 5 These organisations can use the future volume licenses that are negotiated by SLM Rijk with Google.

Pursuant to Article 35 GDPR, data controllers are obliged to carry out a DPIA if the processing meets two, and perhaps three, of the nine criteria set by the European Data Protection Board (EDPB), or if it is included in the list of criteria when a DPIA is mandatory in the Netherlands.6

If Dutch government organisations used G Suite Enterprise, this would frequently lead to data processing on a large scale. Because G Suite is a cloud service, it is inevitable that Google processes personal data about the behaviour of employees and administrators. Additionally, Google may process data about third parties when their personal data are included in for example spreadsheets, emails and documents. The data processing involves data about the communication (be it content or metadata).

Criteria EDPB The circumstances of the data processing via G Suite Enterprise meet three out of the nine criteria defined by the EDPB:

• There is a possibility that the processing operations (via the Google cloud log files and through the security tools for system operators) lead to a systematic observation of the behaviour of employees (criterion 3); • The processing involves data relating to vulnerable data subjects (criterion 7, both employees and other data subjects whose personal data are processed through the G Suite Enterprise services are in an unequal relationship of power with the government organisations); • Large scale processing of data (criterion 5, the processing potentially affects all employees of a government organisation, and possibly databases with data about many citizens).7

Apart from that, in their Opinion on data processing at work, the European Data Protection Authorities (EU DPAs) recommend that organisations conduct a DPIA before using “office applications provided as cloud service, which in theory allow for very detailed logging of the activities of employees.”8

The EU DPAs mention work applications as one of the eight relevant monitoring technologies and write: “Irrespective of the technology concerned or the capabilities it possesses, the legal basis of Article 7(f) [since replaced by GDPR art. 6(1) f, addition by the authors] is only available if the processing meets certain conditions. Firstly, employers utilizing these products and applications must consider the proportionality of the measures they are implementing, and whether any additional actions can be taken to mitigate or reduce the scale and impact of the data processing. As an example of good practice, this consideration could be undertaken via a DPIA prior to the introduction of any monitoring technology.”9

Criteria Dutch Data Protection Authority The Dutch Data Protection Authority mentions one other specific criterion when a DPIA is mandatory:

6 Dutch DPA, (in Dutch only), list of DPIA criteria published in the Staatscourant (Dutch Government Gazette) of 27 November 2019 , URL: https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/stcrt-201964418.pdf 7 EDPB adopted Guidelines on Data Protection Impact Assessment (DPIA) (wp248rev.01), 13 October 2017, URL: http://ec.europa.eu/newsroom/document.cfm?doc_id=47711 8 Article 29 Working Party, WP 249, Opinion 2/2017 on data processing at work, 23 June 2017, p. 13, URL: https://ec.europa.eu/newsroom/article29/itemdetail.cfm?item_id=610169 9 Idem, p. 14.

“Communication data (criterion 13). Large-scale processing and/or systematic monitoring of communication data including metadata identifiable to natural persons, unless and insofar as this is necessary to protect the integrity and security of the network and the service of the provider involved or the end user's terminal equipment.”10

This may apply to the G Suite Enterprise services, as the monitoring of communication data could be necessary to protect the integrity and security of the network.

However, in order to be able to assess the impact of the data processing and to determine whether the actual processing meets the requirement of necessity, the government organisations must first carry out a DPIA (or have it carried out). This DPIA compares the opportunities with the risks and assesses whether measures are possible and necessary to mitigate any risks.

In GDPR terms SLM Rijk is not the data controller for the processing of personal data via the use of the G Suite Enterprise services. However, as central negotiator for many cloud services, SLM Rijk has a moral responsibility to assess the data protection risks for the employees and negotiate for a framework contract that complies with the GDPR. Therefore, SLM Rijk commissions umbrella DPIAs to assist government organisations to select a privacy-compliant deployment, and conduct their own DPIAs where necessary. Only the government organisations themselves can assess the specific data protection risks, related to the technical privacy settings, nature and volume of the personal data they process and the vulnerability of the data subjects.

This umbrella DPIA is meant to help the government organisations with the DPIA they must conduct, but this document cannot replace the specific risk assessments the individual government organisations must make themselves.

Different G Suite editions

This report refers to G Suite Enterprise services. In December 2020, after completion of this report, Google has renamed these services in Google Workspace. Google provides three different editions of G Suite: G Suite Basic, G Suite Business and G Suite Enterprise. G Suite also offers learning and collaboration tools for schools through G Suite for Education (a ‘free’ version) and G Suite Enterprise for Education editions.11 Google also offers ‘free’ versions of many core applications, such as Gmail, Docs, Hangout, Forms and Slides.

One of the key differences between the free applications and G Suite Enterprise is that the institutions can select the data region to store the Customer Data at rest from certain Services. G Suite Enterprise also offers advanced administration controls such as the G Suite Security Center and Mobile Device Management for administrators (also referred to as ‘admins’ in this report). G Suite Enterprise includes additional functionalities, such as enhanced analytics in BigQuery, Cloud Search across G Suite information, an eDiscovery solution called Google Vault, advanced features of the communication tool Hangouts (including video conferencing) and enhanced support.

Scope of this DPIA: G Suite Enterprise

This DPIA examines the risks of the use of G Suite Enterprise via the Chrome browser on 3 platforms: ChromeOS (on a Chromebook), mac OS and Windows 10.

10 See footnote 6. 11 Google, Choose your G Suite edition. Try it free for 14 days. URL: https://gsuite.google.com/pricing.html