Skip to main content

Google and Student Data Privacy

Student Data Privacy : G Suite (Formerly known as Google Apps for Education (GAFE))
Student Data Privacy : G Suite (Formerly known as Google Apps for Education - GAFE) 
G Suite (Formerly Google Apps for Education) is a package of cloud-based services that can provide a school district a new way to work together online-not just using email, but over video conferences, and real-time document collaborations, and more.
"The G Suite for Education (formerly called Google Apps for Education) core services are the heart of Google’s educational offering to schools. The core services are Gmail (including Inbox by Gmail), Calendar, Classroom, Contacts, Drive, Docs, Forms, Groups, Sheets, Sites, Slides, Talk/Hangouts and Vault. These services are provided under the G Suite agreement."
"Schools can use G Suite core services in compliance with COPPA and FERPA. G Suite core services contain no advertising and do not use student data for advertising purposes."
"More than 50 million students, teachers and administrators in almost every country in the world rely on G Suite to learn and work together. We are committed to protecting the privacy and security of all our users, including students."
"Please note that there are additional services outside of the G Suite core services that G Suite users can access. These services are not governed by the Student Privacy Pledge or the G Suite agreement, so we may use student data in ways we would not for G Suite core services. For example, additional services may serve ads, and Google may use student data in these additional services on an anonymous, aggregate basis to improve our services. For G Suite users in primary/secondary (K-12) schools, Google does not use any user personal information (or any information associated with a Google Account) to target ads. Please review the G Suite Privacy Notice, Google Terms of Service and Google Privacy Policy. Learn more about the differences between core services and additional services below."
"Hundreds of school districts throughout California and the rest of the country use a suite of education products formerly called Google Applications for Education (“GAFE”) and recently renamed G Suite for Education ("G Suite"). Questions have been raised as to whether G Suite complies with the Family Educational Rights and Privacy Act
(“FERPA”) found in 20 U.S.C. 1232(g), and California Assembly Bill (“AB”) 1584 found in California Education Code section 49073.1. Both laws establish privacy protections for pupil records stored or analyzed by digital education providers. These protections include, but are not limited to:
  1. prohibitions against the unauthorized use of the records;
  2. requirements to allow a student or parent to access the records; 
  3. disposal of the records at the end of the term of the agreement; and requirements to maintain adequate safeguards for the records, including notification of unauthorized access to pupil records."
"One reason questions may have been raised about G Suite data privacy compliance is that not all FERPA and AB 1584 required terms are found in the G Suite for Education Online Agreement (“G-Suite Online Agreement”). Given the widespread use of G Suite there was an urgent need to determine whether G Suite complies with FERPA and AB
1584. CETPA and its counsel, Fagen Friedman & Fulfrost, undertook an extensive analysis of the G Suite privacy terms and conditions, including the G Suite Online Agreement."
"The analysis found that central to determining privacy compliance is understanding that the G Suite privacy terms and conditions consist of more than just the G Suite Online Agreement. FERPA and AB 1584 requirements can be found in several additional G Suite documents, including but not limited to: the G Suite Privacy Notice; the Additional
Terms for Use of Additional Services; and the Data Processing Amendment to G Suite Agreement."
"When taken together, these documents show that G Suite likely complies with all material portions of FERPA and AB 1584. In most cases, the elements of the data privacy requirements are explicit in G Suite's privacy terms and conditions. However, some aspects of FERPA and AB 1584 requirements are not referenced verbatim in privacy terms and conditions. Some of those requirements require statutory interpretation to conclude that G Suite has met a particular data privacy requirement." "There are two factors of the data privacy compliance laws that require statutory interpretation to conclude that G Suite has met its obligations under FERPA and AB 1584. The first requirement is to provide students with the opportunity to establish a separate account for student-generated work and the second is the right of a parent to access a pupil's record and correct any erroneous information. Currently, the G Suite privacy terms and conditions state that G Suite will only take a ministerial role to meet these obligations."
"The issue then is whether the federal and state laws require Google to actively manage these processes, or whether Google’s role may be ministerial by implementing the directions of a school district. We conclude that the creation of a separate account and the modification of pupil records is a power that AB 1584 and FERPA intended to leave to school districts and not to Google. Therefore, Google’s ministerial role stated in the G Suite privacy terms and language on these two topics is consistent with the intent of the statutes."
"CETPA’s finding that the G Suite data privacy terms and conditions comply with FERPA and AB 1584 is bolstered by recent findings of Ernst & Young, which held that G Suite privacy terms and conditions were consistent with the privacy standards established by the International Standards Organization for data privacy. These standards have many similarities to those found in FERPA and AB 1584. We hope this guidance will provide reassurance to the many California school districts using or contemplating the use of G Suite. Please note that student data privacy laws are relatively new and subject to interpretation, and G Suite may amend its terms and conditions at any time, which could alter the foregoing analysis and findings. CETPA has posted the underlying legal analysis supporting this conclusion on Resources page."