How the Netherlands is taming Big Tech

In 2021, privacy consultants working for two Dutch universities published a critical bulletin on Google’s education apps, a set of classroom tools like Google Docs that are used by more than 170 million students and teachers around the world. the world.

The audit warned that Google’s tools for schools lacked a number of privacy protections – like tight limits on how the company could use students’ and teachers’ personal data – which were required by European legislation. Although the company addressed some of the concerns, according to the report, Google refused to comply with requests from the Netherlands to reduce a number of “high risks” cited in the audit.

It took a threat from the Dutch Data Protection Authority, the national privacy regulator, to help break the deadlock: Dutch schools should soon stop using Google’s educational tools, a said the government agency, if the products continued to present these risks.

Two years later, Google developed new privacy measures and transparency tools to address Dutch concerns. The tech giant now plans to roll out these changes to its education customers later this year in the Netherlands and elsewhere.

The Dutch government and educational organizations have had remarkable success in forcing major tech companies to make major privacy changes. Their carrot-and-stick approach engages high-level Silicon Valley executives in months of highly technical discussions, then pays off by negotiating collective bargaining agreements that allow companies to sell their vetted tools to various government departments and schools around the world. country. And Dutch efforts to bring about change could provide a playbook for other small nations struggling with technological superpowers.

For some US tech companies, the Dutch imprimatur has now become a status symbol, a sort of stamp of approval they can show to regulators elsewhere to demonstrate that they have passed one of the protection compliance processes. strictest data in Europe.

How the Netherlands, a small country of about 17.8 million people, came to influence American tech giants is a David and Goliath story involving a landmark law, called the General Privacy Regulations. data, which was implemented in 2018 by the European Union. Member States.

This European legislation obliges companies and other organizations to minimize their collection and use of personal information. It also requires companies, schools and others to conduct audits, called data protection impact assessments, for certain practices, like the handling of sensitive personal information, that could pose high privacy risks.

But the Dutch central government and educational institutions have gone much further, commissioning comprehensive technical and legal assessments of complex software platforms such as Microsoft Office and Google Workspace, and securing high-level business participation in the process. .

“They have a centralized approach which allows for scalable solutions,” said Julie Brill, the privacy officer at Microsoft. “The Netherlands are punching above their weight.”

Last year, Zoom announced major changes to its data protection practices and policies after months of intensive discussions with SURF, a cooperative in the Netherlands that negotiates contracts with technology providers on behalf of universities and Dutch research institutes.

Lynn Haaland, chief privacy officer at Zoom, said the discussions helped the video communications company understand how to improve its products to meet European data protection standards and “be more transparent with our users”.

Among other things, Zoom released an 11-page document detailing how the company collects and uses the personal information of people participating in meetings and chats on its platform.

Dutch technical expertise has helped privacy auditors gain unusually precise insights into how some of the biggest software companies collect personal data on hundreds of millions of people. It has also enabled Dutch experts to challenge companies for practices that appear to breach European rules.

Some big U.S. tech companies balk at first, said Sjoera Nas, a senior adviser at the Privacy Company, a consultancy in The Hague that does data risk assessments for the Dutch government and other institutions.

“We’re so small that in the beginning a lot of cloud providers look at us, raise an eyebrow and say, ‘So what? You are the Netherlands. You don’t matter,” said Ms Nas, who helped lead Dutch negotiations with Microsoft, Zoom and Google. But then, she said, companies start to understand that Dutch teams are negotiating compliance for the Netherlands with data protection rules that also apply across the European Union.

“Then the technology providers realize that they won’t be able to provide their services to 450 million people,” Ms. Nas said.

The Dutch effort began to gain momentum in 2018, after the country’s Ministry of Justice and Security commissioned an audit of an enterprise version of Microsoft Office. Report says Microsoft systematically collected up to 25,000 types of user activity, like spelling changesand software performance details of programs such as PowerPoint, Word and Outlook without providing documentation or giving administrators the ability to limit this data collection. In a blog post at the time, Ms Nas, whose firm carried out the audit, described the findings as “alarming”.

Consumer software typically collects tons of usage and performance data from users’ devices and cloud services – diagnostic data that US tech companies often use freely for commercial purposes such as developing new services . But under EU law, diagnostic data linked to an identifiable user is considered personal information, just like emails a person sends or photos they post.

This means companies must limit their use of personal diagnostic data and provide individuals with copies upon request. The Dutch audit revealed that Microsoft had failed to do so.

Microsoft has agreed to fix these issues. In 2019, the company introduced a new privacy and transparency policy for cloud customers worldwide, which included “changes requested by the Dutch Ministry of Justice,” Ms Brill wrote in a blog post. the society. Microsoft has also released a data visualization tool to let customers see the “raw diagnostic data” that Office has sent to the company.

Ms Brill said talks with the Dutch had helped Microsoft adopt European views on data protection, a shift in corporate culture that she said was more important than software changes.

“It starts with culture and then makes sure the cultural pivot shows up in our products and software and, more importantly, in how we describe what we do to our customers,” Ms. Brill said.

The pandemic has accelerated the Dutch effect on American tech companies.

In 2021, the Dutch audit of Google’s tools for schools, now known as Google Workspace for Education, reported that the products lacked certain privacy controls, transparency and contractual limits regarding their use of personal data. . Educational tools included apps such as Gmail and Google Classroom, an online learning center.

Google eventually agreed to Dutch demands to significantly restrict how the company could use personal data collected by its educational tools, something US regulators failed to accomplish.

Among other things, Google agreed to limit how it uses diagnostic data from its basic education apps to just three fixed goals, down from more than a dozen goals. The three uses included providing services to customers and managing issues such as security threats.

Google has also agreed not to use diagnostic data for purposes such as market research, user profiling or data analysis. And he agreed to develop a tool for education customers to see their diagnostic data.

“We had to explain to Google that school boards have a duty of care and that they need to control students’ personal data,” said Job Vos, data protection officer for SIVON, a Dutch cooperative that negotiates contracts. with technology providers. on behalf of Dutch schools, which have been involved in years-long discussions with Google. “It cannot be used for commercial purposes.”

In a recent interview, Phil Venables, chief information security officer at Google Cloud, said that Google regularly works with regulators around the world and does not consider discussions with the Dutch – or the resulting changes in the Google’s data practices – as particularly noteworthy. He added that society welcomes the technical sophistication of Dutch efforts.

“We were happy to work with the Dutch because they were demanding about it,” Venables said, “and we responded to that.”

Google has agreed to deliver new privacy controls and transparency tools by the end of 2022. Ms. Nas and Mr. Vos said they are now testing Google’s proposed solutions, a process that could take months .

Dutch efforts could improve the privacy of schools in the United States and elsewhere, many of which lack the in-house technical expertise to independently investigate how complex platforms like Google collect and use student data.

But Dutch privacy experts see their audit and negotiation process as part of a much larger effort by countries trying to assert their digital sovereignty against America’s tech superpowers.

“We’re basically being captured by the tech behemoths,” Ms. Nas said. “We are starting to realize that the only way to deal with this is to negotiate our way to their compliance with European standards.”