# Tietosuojavaltuutetun toimisto (Finland) - TSV/40/2018

- Type: Enforcement
- Source: Tietosuojavaltuutettu
- Date: 2026-09-28
- Original: https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_TSV/40/2018
- Canonical: https://overview.legal/posts/354329
- Topics: Personal Data, Processing, Controllers, Lawful Basis, Supervisory Authorities, Consent

## Summary

The DPA ordered a city to ensure that the personal data of pupils collected when using digital learning tools was only processed to fulfill the controller’s educational obligations. English Summary. Facts. In April 2018, the DPA received a complaint stating that the city of Espoo (the controller) was using Google's digital learning tools in a school without obtaining consent from pupils’ (the data subjects’) parents. The controller clarified that it used a number of Google applications for

## Full text

The DPA ordered a city to ensure that the personal data of pupils collected when using digital learning tools was only processed to fulfill the controller’s educational obligations. English Summary. Facts. In April 2018, the DPA received a complaint stating that the city of Espoo (the controller) was using Google's digital learning tools in a school without obtaining consent from pupils’ (the data subjects’) parents. The controller clarified that it used a number of Google applications for educational purposes, including Google Classroom, Google Drive, and Google Docs. It invoked Article 6(1)(c) GDPR as the legal basis for the processing. According to the controller, the processing of personal data in connection with using these services was necessary to comply with the obligation to provide basic education laid down in the Finnish Basic Education Act. The DPA issued a decision in case 1509/452/18 in December 2021. This decision was appealed to the Supreme Administrative Court, wh

---
Generated by overview.legal · https://overview.legal/posts/354329 · 2026-09-29