Espoon kaupunki – Violation Found (Finland, 2026)

In April 2018, the DPA received a complaint stating that the city of Espoo (the controller) was using Google's digital learning tools in a school without obtaining consent from pupils’ (the data subjects’) parents. The controller clarified that it used a number of Google applications for educational purposes, including Google Classroom, Google Drive, and Google Docs. It invoked Article 6(1)(c) GDPR as the legal basis for the processing. According to the controller, the processing of personal data in connection with using these services was necessary to comply with the obligation to provide basic education laid down in the [https://www.finlex.fi/fi/lainsaadanto/1998/628 Finnish Basic Education Act]. The DPA issued a decision in case 1509/452/18 in December 2021. This decision was appealed to the Supreme Administrative Court, which referred the case back to the DPA in its decision KHO:2025:29 in April 2025. The Supreme Administrative Court held that the DPA could not conclude Article 6(1)(c) GDPR was not applicable in any respect as a legal basis for the processing. In the present proceedings, the DPA was to decide the extent to which the controller could invoke the compliance with a legal obligation as a legal basis for the processing of personal data related to the use of Google’s digital learning tools. The DPA ordered the controller to ensure that the personal data of pupils collected in connection with the use of Google's digital learning tools was solely processed for the purpose of fulfilling the controller's educational obligations. The processing could be based on Article 6(1)(c) GDPR only under these conditions. The DPA held that the controller could invoke Article 6(1)(c) GDPR as a legal basis for the use of learning tools essential to teaching. In addition, the processing must be carried out solely to fulfill educational obligations. The DPA pointed out that this legal basis applies to the use of tools that are central to teaching, such as text editors, calendars, email, presentation software, and programs intended for subject-specific instruction (such as language or math applications). When assessing the necessity requirement, the DPA took into account that digital learning tools can enable the extensive and long-term collection and other processing of school-aged children’s personal data by and for the benefit of external entities. Therefore, it held that the controller may not disclose or otherwise grant access to this data to the controller or other parties in a way that allows the controller to process the data for its own purposes, such as developing the learning tools or other services.