City of Espoo – Court Ruling (Finland, 2025)

The City of Espoo (controller) had implemented Google Workspace for Education in the primary schools under their remit. The controller relied on Article 6(1)(c) GDPR to do so, believing the measure necessary for compliance with their legal obligation to organise basic education. On 30th December 2021, the Finnish DPA held that Article 6(1)(c) GDPR did not provide a valid lawful basis for the processing in question, and the use of the e-learning platform was not in compliance with the GDPR. The DPA noted that processing based on the ground of legal obligation must explicitly refer to the nature and purpose of the processing. The DPA commented that the Basic Education Act does not refer to the nature of the processing or require the implementation of an e-learning platform, thus leaving the controller with significant discretion in fulfilling their obligation and rendering the use of this provision as a legal obligation inappropriate. During the investigation, the DPA also highlighted the fact that this processing operation involved the collection of large amounts of data (including sensitive data) of children who are vulnerable data subjects, both while they are at home and at school. Also, the amount of data processed was far higher than that which would be processed under a traditional pre-school education arrangement. Additionally, the controller had to accept Google’s standard terms and conditions which limited their ability to control the processing taking place. The DPA therefore concluded that the use of such an e-learning platform cannot be automatically considered necessary and proportionate to allow the controller to justify the processing without having performed a case-by-case assessment in light of their obligation to organise basic education. On 30th June 2023, the Administrative Court rejected the controller’s appeal against the decision. The Court reasoned that the Basic Education Act does not define the means of processing and thus leaves the controller with too much discretion in order to rely on the provision as providing a legal obligation to introduce the system. The Court also noted that the processing was not limited to what was necessary and proportionate for school purposes and the limited discretion that the controller had over the system after agreeing to the platform’s general terms of use. The controller then appealed to the Supreme Administrative Court, requesting that the decision of the Administrative Court and the DPA be annulled and confirmation that they may rely on Article 6(1)(c) for this processing operation. In their submissions, the controller argued that the use of Google Workspace is necessary to comply with both their obligation to provide basic education and also their obligation to equip pupils with computer skills (ICT) available in the public domain. The controller argued that both the DPA and the administrative court have failed to take proper account of this. The controller also called for a more detailed analysis of the different offerings present in the Google Workspace environment by examining each independently deployable application to assess the extent to which the lawful basis may apply. The “all-or-nothing” approach in assessing legitimacy of the system adopted by both the DPA and the administrative court was inappropriate, the controller argued. The DPA requested that the controller’s claims be dismissed. The DPA submitted that the obligation to provide basic education simply could not lead to an obligation to use Google’s educational software, that such a measure is not necessary for the provision of basic education. The DPA further argued that the processing in question is extensive and the controller is unable to exercise control over the pupil’s personal data, nor even to provide an actual explanation of how the processing is conducted, instead relying on service descriptions and contractual terms provided by Google. According to the DPA, the controller has not demonstrated that they have performed a proper assessment of the e-learning system. At the outset, the Court noted that the lawful basis under Article 6(1)(c) must be interpreted strictly as it entails the processing of personal data without the consent of the data subjects. The Court referenced the judgment in C-394/23 Mousse in finding so. The Court also noted that processing under this basis must be based on Union or Member State law meeting an objective of public interest and must be necessary and proportionate to achieve those objectives. The Court then considered whether the Basic Education Act even constitutes a legal obligation of the controller, compliance with which the use of an electronic education platform could be based upon. The Court highlighted that the decisions of both the Administrative Court and DPA concluded that the fulfilment of the obligation under the Basic Education Act could not be seen as requiring the use of an e-learning platform. The Court disagreed with this premise. The Court acknowledged the existence of the controller’s obligation under the Basic Education Act to provide basic education. The Court further referenced the National Board of Education’s objectives as to the content of basic education which stress the importance of technological literacy for pupils. The Court reasoned, therefore, that such an objective must be deemed to require the use of ICT-based learning environments to develop these skills in basic education. The Court concluded that there exists, therefore, a clear and precise legal basis for the processing of personal data necessary for the use of such applications for this purpose. The Court thus found that compliance with the controller’s obligation under the Basic Education Act may provide a basis for the use of an electronic education platform. This differed from the findings of both the DPA and the Administrative Court. As the decisions of the Administrative Court and the DPA were based on an incorrect premise, the Court found them to be incorrect. The Court noted that while the controller’s obligation does not require the use of the Google platform specifically, this does not necessitate a different assessment, as the GDPR obviously never specifies services or products required to be used by name. The Court concluded that the DPA erred in finding that the controller’s obligation under the Basic Education Act could not provide a lawful basis for the use of an online education platform. The Court did not deem it necessary to consider the extent that the specific processing in question could be considered as fulfilling the controller’s legal obligation. The Court also noted that the Google Workspace platform used different types of personal data for different purposes, for example for identifying users, developing applications etc. The applications could also be used independently of each other. The Court found that the fact that the processing of personal data is not necessary for a specific purpose does not necessarily allow the conclusion that the processing is incompatible with the lawful basis under Article 6(1)(c). This differed from the findings of both the DPA and the Administrative Court on this point, and the Court found their reasoning to be wrong. The Court also referenced the DPA’s comments about the different uses of personal data present in the Google Workspace system (for identifying users, for developing services etc.), the sensitivity of the data involved, and the lack of oversight by the controller on the processing. While the Court did confirm that the controller would have to comply with the other provisions of the GDPR as they relate to these points, these issues were irrelevant from the perspective of the lawful basis, upon which the DPA focused. In conclusion, the Court found that neither the DPA nor the Court could have concluded on the basis of the ground advanced that the processing could not be based on Article 6(1)(c) GDPR. The case was remitted back to the DPA for reconsideration.