Security News > 2021 > March > Dutch government: Did we say 10 'high data protection risks' in Google Workspace block adoption? Make that 8

A Dutch government report identifying "10 high data protection risks" for users of Google Workspace, formerly known as G Suite, has been revised after Google's response, and now says eight high risk issues still remain.

Despite the name, this is not an offshoot of Google's Redmond-based rival, but a government department which manages vendor relations with the company, and which undertook to assess the risks of deploying Google Workspace instead of Office 365, in a process called a DPIA. It has conducted similar studies into privacy risks with Microsoft's services.

Despite these assurances, at the time of writing, the DPIA still considers that there are legal obstacles to adopting Google Workspace around the roles and obligations of data processors and data controllers under the EU's General Data Protection Regulation.

"The use of Google Workspace as offered under the privacy amendment of the Dutch government, still leads to 8 high risks for the different categories of data subjects involved," said the report as updated.

Google is a data processor, but also a data controller, since it also determines how data is used, although the scope of its role as data controller is complicated.

The Netherlands government and Google are joint controllers of data processed through Google Workspace, but the report said that, "Due to the lack of purpose limitation and transparency, Google and the government organisations currently don't have a legal ground for any of the data processing."

News URL

https://go.theregister.com/feed/www.theregister.com/2021/03/05/dutch_government_identifies_10_high/