Jesper Graugaard never expected to become a fulltime GDPR activist. And he certainly didn't expect to create one of the biggest debates ever to take place in Denmark about the protection of children’s data and the role of American tech companies in Danish schools.
Over the course of 4,5 years Jesper Graugaard, a parent of a school child, has worked effortlessly to raise awareness and hold municipalities accountable for the protection of school children using Google Chromebooks for educational purposes.
Illegal use of data
It all started with a data breach in the summer of 2019. The children in his kid’s school involuntarily had their full names, grades, and school name published on YouTube.
“It couldn't be right that my child's name, and all 8000 other children in the municipality's names, should be on social media as a result of them going to school,” Jesper Graugaard says to Wired Relations podcast Sustainable Compliance.
When using Chromebooks, Google collects various personal information about the pupils and uses it for everything from improving security to developing their products.
Now, 4,5 years after Jesper Graugaard’s first meeting with Chromebooks, the Danish DPA has ruled that the data cannot be legally passed on to Google for the purpose of improving and developing their products. Something Jesper is keen to talk about and has made him invite us to his home in Elsinore, where it all started.
No risk assessment made
Back in 2019 It quickly became clear that the municipality of Elsinore had not made the necessary Data Protection Impact Assessment (DPIA) before starting using Chromebooks, which resulted in the breach and sharing of the children's data without the parents' consent.
That didn't sit right with Jesper, who quickly went to the school board and the city council hoping for a solution. Here he was told that “if you can't live with those mistakes, then maybe you should find another school”.
“That announcement shocked me,” Jesper Graugaard says. He decided to report it to the DPA, and before he knew it, the case had snowballed and quickly involved no less than 53 municipalities with the same problem.
Three options to fix the problem
The case has had several DPA decisions along the way as well as a temporary ban on Chromebooks lasting one summer.
The DPA has now decided to give the municipalities a chance to come up with a solution for the legalisation of using Chromebooks and has given them three options to do so. Either the municipalities stop passing on personal data to Google, they make an agreement with Google so they no longer use the data or the parliament changes the law so that the use of Chromebooks as it currently works becomes legal.
“My fear is that they go with option number three and make it legal,” says Jesper Graugaard.
If it was up to him, the ban would have continued, and the schools could have started looking for alternative – Danish – providers.
Has started an important debate
For Jesper Graugaard the heart of the matter is that children have the right to privacy, when they go to school and that their data is not shared with anyone.
“I don't want my children, when they turn 18, to say: Thank you Dad, you taught me to ride a bike and to live a sensible life. But then there is this digital twin. Why hasn't anything been done about it? Yes, I know, someone took a copy of you, but they own it. You have no rights and you have no objections. You cannot withdraw it”.
“So Jesper. In the last 4,5 years – has it become safer to be a school child in Denmark?”
“Absolutely yes. It has started an awakening process in the municipalities, but it has also set in motion an awakening process in the population. That is one of the most important gains of the case”.
