Google admits data mining student emails in its free education apps

[the_dude]

SafeGov.org - Google admits data mining student emails in its free education apps

 

Google now admits that it does data mine student emails for ad-targeting purposes outside of school, even when ad serving in school is turned off, and its controversial consumer privacy policy does apply to Google Apps for Education.

 

 

don't be evil?

Edited February 14, 2014 by the_dude

[ZeroHour]

I am sure people will be along to defend google but this has been a fear of mine for years, they promised not to do it and they did anyway.

[CAM]

What is Microsoft's stance on this and their O365 platform?

 

As for Google, to be expected and I'd be surprised if they didn't mine something. More damaging is their promise they don't do it when ad serving is turned off but continue to mine potentially sensitive information and later serve it up to the kids.

[ZeroHour]

What is Microsoft's stance on this and their O365 platform?

 

o365 has no scanning ability, its not designed for ad's in any way or form according to that article.

Although for US: https://office.microsoft.com/en-us/business/office-365-cloud-privacy-FX103046091.aspx

We do not mine your data for advertising purposes. It is our policy to not use your data for purposes other than providing you productivity services.

[Richard450]

So many people happily use google, microsoft, hotmail, social networking etc in schools for school purposes, having made little or no check about where pupil and staff data will be held e.g. where the servers are. The Data Protection Act has rules about data going outside of Europe as I understand it, and most of these big corps could move data around the world. How do we know where our data goes and sits? If they do not have adequate provisions (e.g. in the US it's sometimes known as 'Safe Harbour' I think, the school could be breaking the law. The European Commission and Parliament are looking at all this as part of the NSA surveillance and there are calls for safe harbour to be withdrawn until it's all checked out. The new proposed EU Data Protection rules may put all sorts of new rues in about contracts with companies not based in Europe. I'm not quite sure how small schools are supposed to have any of the expertise needed to get through this legal and technical minefield tbh.

 

As for Google ads. Are any of us remotely surprised at all? Probably not. Do any of us feel we have any power to stop it? Probably not.

[ZeroHour]

Hotmail/gmail etc are a seperate matter but o365 wise I believe all data is kept in the EU in either Ireland or Amsterdam.

 

I wonder how many schools got the pupils to agree to be mined as per googles rules? o365 does not need this as it doesn't mine data.

The surprising thing is originally everyone thought google ad's off = no mining/sharing but it appears that may not be the case.

[Edu-IT]

So is the answer here to stop using Google mail?

[localzuk]

Seems that way. There have been a few revelations lately, with 'free' cloud solutions that has altered my perception. I certainly won't be rolling them out here now.

[ZeroHour]

So is the answer here to stop using Google mail?

 

Well not necessarily to stop using Google Apps for Edu but I would certainly inform your users that this is going on, not sure if its mandatory for the UK like google claims it is in the the US though but it does seem that data is being mined regardless.

[robjduk]

We use google apps and just assumed they scanned everything from day one along with every other company out there. Its free..... what did you think happened?

[ZeroHour]

We use google apps and just assumed they scanned everything from day one along with every other company out there. Its free..... what did you think happened?

 

Well according to that article originally they had:

If you are using Google Apps (free edition), email is scanned so we can display contextually relevant advertising in some circumstances. Note that there is no ad-related scanning or processing in Google Apps for Education or Business with ads disabled.

Which has now been removed, that was pretty clear wording that they wouldnt do that.

 

Did you get permission from parents/pupils and make them aware out of interest?

Google implies you have to but that may be usa only probably due to the fact they will use tracking while the pupil is logged in browsing youtube etc from home and target based on their inbox email.

Edited February 15, 2014 by ZeroHour

[3s-gtech]

Even more glad I chose Exchange now!

[rdk]

This is what Google says:

 

Our systems scan and index emails and some other user data for multiple purposes; this scanning is 100% automated and cannot be turned off. Scanning enables us to, for example, perform spam and malware detection, sort email for features like Priority Inbox, and return fast and powerful search results when users search for information in their accounts. The scanning and indexing that our systems run also enable us to display contextually relevant advertising, including in Gmail. If your domain disables ads, we will not use your data to display such advertising to your users. Domains using the free edition of Google Apps cannot disable ads.

 

While using youtube while logged in into my account it's certainly clear that video suggestions are based on what I've watched previously, and adds served based on ebay searches and other product searches, but I've never noticed anything based on what's in my email. I might try emailing 20 times about some obscure product I'm not interested in and see what happens.

[ADMaster]

Not to defend Google, because I am certainly not a fan of them mining our students’ data.

However here is an article saying that safegov is nothing more than a smear campaign by Microsoft targeting Google.

Google's FTC Settlement Is An Epic Fail For Microsoft – ReadWrite

[harriuk]

Just to confirm. MS store their O365 data for education in the EU. I had it confirmed straight from the horses mouth so to speak.

[edutech4schools]

Just to confirm. MS store their O365 data for education in the EU. I had it confirmed straight from the horses mouth so to speak.

 

EU demands answers over Microsoft's Patriot Act admission | ZDNet

[localzuk]

Indeed. There is an issue with 'US Homed' companies and EU data protection principles. Basically, if a company is in the USA but has EU subsidiaries or facilities, the US Patriot Act (and probably other laws too) render EU law a moot point - as failing to comply with the Patriot Act is a fairly huge thing and would effectively be the end of that company if the US govt so wished. So, faced with the potential of the EU shouting loudly and fining them a few Euros, or a life sentence for anyone involved, the company is going to go with handing over data.

[harriuk]

That's why I love this forum, someone, somewhere has a bit of info you didn't have before you read the forum post!

 

Ok so the Patriot Act trumps the Data Protection Act, but in practice, how likely is it to be implemented in such a way that your data will be requested? Isn't it more likely that you will lose data via one of the highly trained data processors that handle this data on a day to day.

Edited February 16, 2014 by harriuk

[jamesbmarshall]

If anyone wants information about Microsoft's standpoint on this, check: Office 365 Trust Center

 

Also, Your Privacy is Our Priority - UK Education Cloud Blog - Site Home - MSDN Blogs

[fiza]

So what, in reality, does this mean for schools who have rolled out Google apps for edu or are about to? if we have to let students know about this can they then opt out? where would that leave schools? We are at a cross roads - 365 or google - I was leaning towards google but now.......

[ZeroHour]

So what, in reality, does this mean for schools who have rolled out Google apps for edu or are about to? if we have to let students know about this can they then opt out? where would that leave schools? We are at a cross roads - 365 or google - I was leaning towards google but now.......

 

Do you have a link to any terms you would have with Google Apps? just curious if it requires you to inform your pupils or not. I dont think there is an opt out other then not having a google apps account.

[fiza]

Do you have a link to any terms you would have with Google Apps? just curious if it requires you to inform your pupils or not. I dont think there is an opt out other then not having a google apps account.

 

I didn't mean an opt-out option within Google I meant if the students didn't agree then they would opt-out of having a google apps account then where would that leave the school? You couldn't then have the whole school on google apps.

[ZeroHour]

I didn't mean an opt-out option within Google I meant if the students didn't agree then they would opt-out of having a google apps account then where would that leave the school? You couldn't then have the whole school on google apps.

 

The reason I wondered is the article is a USA based one, the EU Google Apps may be different or have different terms, but yeah I suspect you may be correct there. The thing that gets me is the stealth change from not mining to mining without anyone aware (if it applies in EU)

[pcstru]

I've tried to make the point before that the wording of the Domain Setting implied that while ads would not be served, the processing was going on. I was told I was wrong by various people including Google employees.

 

The problem for schools is that to comply with the Data Protection Act, data must be processed fairly, it must be transparent what data you are processing and why, and a subject may request access to their data and schools are obliged to supply data they hold.

 

If your school uses Google Apps, Goggle are processing data under your schools registration. They are acting as a supplier of services to your school. How do you tell your data subjects what processing you are doing when you don't know? How can you say data is being processed fairly, when you have no control over the processing (and when the supplier has lied to you that it is actually doing any processing)? How can you comply with a subject access request which should now include metadata google collects, when you have no access to that data?

 

It looks to me that the use of Google Apps for Education in the UK is fundamentally incompatible with a Schools obligations under the DPA. I'm surprised there isn't more discussion of this.

[PotNoodleTech]

This confirms my suspicion that when using cloud services you are effectively handing your data over to a third party with no actual control over what your data is actually used for now, or in the future.

 

Worrying. As far as I can see, private clouds are the only answer, so that you can deliver cloud services to pupils and teachers, whilst still remaining 100% in control of the data and the hardware which sits safely in your server room. Not cheap though!!