The decision clarifies the strict conditions under which a public entity may rely on its legal obligation to process data on a digital platform provided by a third party, emphasizing the prohibition for the latter to use the data for its own purposes.

Facts and context

The Finnish Data Protection Authority (Tietosuojavaltuutettu) today published a new decision concerning the use of the educational platform "Google Workspace for Education" by the city of Espoo, specifying the lawfulness conditions for processing students' data.

The case originated from a complaint filed in 2021, leading to a first decision by the authority, which was then annulled and referred back for reconsideration by the highest administrative court in April 2025.

Reasons for the decision

• Lawfulness of processing obligation (Article 6 of the GDPR): The authority clarifies its previous position by confirming that the legal obligation to organize primary education can constitute a valid legal basis for processing students' personal data via a digital educational platform. However, this legal basis only covers processing strictly necessary for the purpose of education. The authority concluded that allowing the service provider or third parties to access personal data for their own purposes, such as service development or profiling, exceeds what is necessary for organizing education. Therefore, such secondary processing lacks a valid legal basis.

Decision of the authority

Consequently, the authority clarified that the processing of personal data on the platform is lawful only if the data are not used by the service provider or third parties for their own purposes.

Lessons learned

This decision specifies that:

• The legal basis of the legal obligation incumbent on a public controller can only be invoked for processing activities strictly necessary to fulfill this mission, and does not extend to the processor's own purposes, such as improving its products.
• The accountability principle requires public entities, notably municipalities and schools, to select their digital service providers with extreme diligence. They must ensure that the terms of use and contracts explicitly prohibit any reuse of personal data by third parties.
• The assessment of the necessity of processing must be carried out exclusively with regard to the controller's objectives, and not the operational or commercial needs of its processors.