The enrolment framework for G Suite Enterprise

Figure 10: Feedback

The enrolment framework for G Suite Enterprise

Google generally offers G Suite Enterprise as an online enrollment, that can be procured on its website. However, large customers such as the Dutch government may enter into a specific offline agreement called the Cloud Master Agreement.

In Clause 2.1 of the G Suite DPA Google explains that there are different types of enrollment agreements: “G Suite Agreement” means a G Suite Agreement; a G Suite for Education Agreement; a Google Cloud Master Agreement with G Suite Services Schedule; or any other agreement under which Google agrees to provide any services described in the G Suite Services Summary to Customer.”67

This report uses the most recently available public versions of the relevant contractual documents.

67 Data Processing Amendment to G Suite and/or Complementary Product Agreement (Version 2.2), Section 2.1 Definitions, URL: https://gsuite.google.com/terms/dpa_terms.html, hereinafter: G Suite DPA.

1.5.1 Relevant data protection terms and conditions The following documents may contain data protection terms for G Suite Enterprise: • G Suite DPA • G Suite EU Model Contract Clauses (separate agreement entered by Google LLC with the customer) • G Suite Service Specific Terms68 • G Suite [Core] Services Summary69 • Google Additional Product Terms70 • G Suite Acceptable Use Policy71 • G Suite Technical Support Services Guidelines (TSS)72 + • Google Privacy Policy for end users73 • Google Terms of Service for end users74 • Separate Terms75 and Privacy Notice for Chrome browser and OS76

Note: after completion of this report in July 2020, Google published new documents and negotiated a privacy amendment with the Dutch government. These improvements are described in the new assessment of the risks added to the summary and conclusion of this report in January 2021.

1.5.2 Google Account The G Suite DPA only applies to the Customer Data in the Core Services. 77

The G Suite DPA does not apply to the processing in connection with a Google Account (though Google has explained it does apply the G Suite DPA when the Account is used in conjunction with a Core Service), or to the use of the Additional Services, such as YouTube, Maps and Search. Google explains: “These products [Additional Services] are not part of the G Suite offering and are not covered by the G Suite DPA.”78

Google explained to the researchers that there is a hard distinction between the Core G Suite Enterprise services and the many consumer services Google offers globally.79

68 G Suite Service Specific Terms, URL: https://gsuite.google.com/terms/serviceterms/ 69 G Suite Services Summary, URL: https://gsuite.google.com/terms/user_features.html 70 Google Cloud Additional Product Terms, URL: https://gsuite.google.com/intl/en/terms/additional_services.html 71 Google G Suite Acceptable Use Policy, URL: https://gsuite.google.com/terms/use_policy.html 72 Google, G Suite Technical Support Services Guidelines, URL: https://gsuite.google.com/terms/tssg.html 73 Google Privacy Policy. The version used for this report was last updated 31 March 2020, available at https://policies.google.com/privacy?hl=en#intro. URL last visited on 17 June 2020). 74 Google (consumer) Terms and Services. The version used for this report was last updated on 31 March 2020, available at https://policies.google.com/terms (URL last visited 17 June 2020). 75 Google, Google Chrome and Chrome OS Additional Terms of Service, URL: https://www.google.com/chrome/terms/?hl=en 76 Google Chrome Privacy Notice, Last modified: May 20, 2020, URL: https://www.google.com/chrome/privacy/?hl=en 77 As well as services identified as ‘Other Services’ in the G Suite Services Summary and services described in the Complementary Product Services provided under a separate agreement. These services are out of scope of this DPIA. 78 Google Workspace Data Protection Implementation Guide, December 2020, p. 5, URL: https://services.google.com/fh/files/misc/ google_workspace_data_protection_guide_en_dec2020.pdf 79 [CONFIDENTIAL]