In a ruling that went almost unnoticed last week amidst the furore of the PRISM scandal in the US, Sweden’s Datainspektionen (data privacy watchdog) has stepped in to ban a local authority from using Google Apps, saying the company’s privacy policy is not compatible with the country’s privacy laws. Following this decision, the data protection authority said it’s also looking into banning Swedish schools from using Google services as well.

Simon Davies of Privacy Surgeon writes that the ruling, which forbids Swedish government workers in the municipality of Salem from using such services as Google Calendar, Gmail and Google Docs, is based on “inadequacies” in Google’s standard contract. The Datainspektionen carried out a risk assessment of Google’s contract, and ruled that the company gives itself too much discretion over how it can use the data it collects. Henceforth, public sector workers cannot ensure that people’s data protection rights are not being infringed upon.

A number of examples of these ‘inadequacies’ are detailed in the assessment. Firstly, the Datainspektionen notes that Google is particularly vague over how the data might be mined and processed, and it also cites a lack of uncertainty over which subcontractors might be involved in this process. It also said that Google was vague as to whether or not any data collected would be deleted at the end of the contract.

As for Google’s reaction, the company gave one of its typical boilerplate responses in a statement to PC World, in which it said “Google Apps complies with Swedish law,” and that it will “continue to work with all involved parties,” to resolve the matter.

Google’s Problem: A Lack of Trust

The ruling comes at a sensitive time for Google, and not just because it’s become embroiled in controversy over its alleged participation in the NSA’s PRISM program in the US. While fears that Google is willingly cooperating with US authorities to give them unrestricted access to its data will only heighten paranoia among Europeans, this latest case relates to the company’s own privacy policy. This has already drawn the attention of EU data protection regulators, who are currently deciding whether or not to take action over Google’s decision to combine the privacy policies of its entire range of products and services into just one, and amalgamate all of the data it collects from them.

Sweden’s move to ban Google Apps isn’t unprecedented in Europe. Only last year, Norway declared that the use of Google products was in contravention of its own data protection laws, and banned local municipalities from using Google Apps for almost nine months. The ban was only lifted following long negotiations which resulted in Google making a few chances to its privacy policy.

According to Davies, Google’s major concern in light of Sweden’s decision will be to avoid a “disintegration of trust”. In particular, schools all over Europe have been racing to adopt cloud services like Google Apps, but their use could be scaled back if Google cannot provide reassurance over the way it uses data it collects.

Some might consider the Swedes to be a bit petty in this case, but if the truth be told, the Datainspektionen probably deserves some applause for the stance its taking. After all, it’s one thing to entrust your own data with Gmail, Outlook.com, Yahoo or whoever, as that’s your own choice. But when local governments are entrusted with looking after their citizen’s data, they have a much bigger burden of responsibility.