The main points are that Elsinore concluded that the risks with using Google Workspace are low, but that it cannot be guaranteed that US authorities won't be able to get hold of the data. In order to be allowed to use Google Workspace, Elsinore must re-evaluate that position and be absolutely sure that such leaks cannot happen. This is the part that might have far-reaching consequences, since Elsinore -- and many others -- don't see that as possible.
I'm in no way an expert when it comes to GDPR, but there's a lot of people who're quite upset about this, since it means any school using Google Workspace is expected to prove data transfer to non-EU entities isn't possible without adequate protection.
GDPR is EU law. And unless some super lawyer shows up from Helsingørs kommune or more likely from Google then this goes not only for Denmark but the rest of the EU as well.
Normally a seller of a piece of software to an institution would provide the documentation, if nedeed, that the piece of software follows GDPR.
Now with Google, Helsingør likely gets the software for free. And Google takes the data and use it for targeting advertisement and maybe other things.
Personally I think the school system in Denmark should only use suppliers with a straight-forward pay and use business model.
Much in the same way I don't think our children's text books should contain advertisement or be sponsored by business or political interests.
Long story short, she claims this will have far-reaching consequences not just for Elsinore, but for other school districs as well.
Elsinore did, indeed, do an analysis, which is clearly stated in the report: https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jul... (also in Danish -- translator link in a sibling comment)
The main points are that Elsinore concluded that the risks with using Google Workspace are low, but that it cannot be guaranteed that US authorities won't be able to get hold of the data. In order to be allowed to use Google Workspace, Elsinore must re-evaluate that position and be absolutely sure that such leaks cannot happen. This is the part that might have far-reaching consequences, since Elsinore -- and many others -- don't see that as possible.
I'm in no way an expert when it comes to GDPR, but there's a lot of people who're quite upset about this, since it means any school using Google Workspace is expected to prove data transfer to non-EU entities isn't possible without adequate protection.