Google classroom turns into a €12k privacy trap for madrid school
A Catholic school in Madrid just discovered that handing kids the keys to the entire internet can cost more than a teacher’s annual salary. Spain’s data-protection authority has slapped Holy Mary Catholic School with a €12,000 fine after confirming the centre used Google Workspace for Education as a wide-open window into pupils’ personal data—and YouTube rabbit holes—without ever asking parents for permission.
The fine prints a red line under classroom tech
The Spanish data Protection Agency (AEPD) found that the school created Gmail accounts for every primary student, logged their daily activity and gave them unrestricted web access inside class hours. One mother’s complaint last year triggered the probe; she told inspectors her two children were watching videos and playing online games instead of studying maths.
Investigators agreed. According to the ruling, the school “processed minors’ personal information for purposes beyond the right to education” and never ran a privacy-impact assessment, a legal requirement when children are involved.
Google Workspace for Education ships with admin controls that can lock sites, filter search results and disable consumer services such as YouTube. Holy Mary simply left everything on. The result: eight-year-olds roaming the open web while the teacher’s back was turned.
Spain’s schools are racing to digitise, but oversight is crawling
The case lands at an awkward moment. Madrid’s regional government is pushing cloud platforms and AI tutors as standard classroom kit, and 87 % of Spanish schools already rely on Google or Microsoft suites, according to a 2023 Education Ministry survey. Yet only 12 % of teachers surveyed said they had received data-protection training in the past year.
Privacy lawyers warn the gap is a litigation magnet. “Any school that hands out accounts without parental consent or security settings is gambling with GDPR Article 8,” says Marta Rivera, a partner at Madrid firm Rivera & Delgado. “The AEPD just showed the dice are loaded.”
For Holy Mary, the penalty is modest—€12,000 is less than the annual fee for 15 pupils—but the reputational stain is harder to scrub. Parents have started a WhatsApp group to demand an external audit of all digital tools, and enrolment for next year has dipped 8 %, local press reports.
The school declined to comment, citing possible appeals. Google stated that Workspace for Education “includes robust privacy controls and we expect schools to configure them appropriately.”
Meanwhile, the mother who filed the complaint has already moved her children to a different centre. “I didn’t sign up for Gmail when I enrolled them in first grade,” she told national radio. “I signed up for school.”