Google Gemini PII Protection

[marcusdstein]

On a call today with my district tech leadership and they are VERY concerned about PII and student data with Gemini. Is there a guide or go-to place or person to address these questions? Ideally, we'd love a person or place to submit these questions.

[kaned]

See this article.

Also:

[claycodes]

Gemini is a core service. It follows the same data privacy as Drive and Gmail. Nothing put into Gemini is used for training purposes when you are in your school account. 

Resources
https://blog.google/products-and-platforms/products/education/gemini-enterprise-grade-data-protectio...

https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy... 

[Justin_W]

Yeah, I think OP needs to find out the core of their concern.

Is there concern that student PII exist in the cloud (Google Drive, Gmail, Docs, Sheets, Classroom ,etc)? 

Or is the concern truely limited to Gemini?

Gemini may not "use your data to train their model" - but your data is still there and a compromised account is still a compromised account with access to that data. (Not unique to Gemini).

It makes more sense to me to be concerned about all the PII floating around your Googleverse.  Not because Google is going to leak it, but because there's a lot more humans involved in handling it.

If you wanted ultimate security, you wouldn't use any cloud service.  You may not eve ngo digital anything.  And then again, you wouldn't be able to exist or compete in any modern business/school.

[MarkB]

Our lawyers also aren't impressed by the information provided by Google in this regard...

- Data flow is an issue and Google doesn't specifically document this process. (Storing and/or manipulating data outside of EU).
- SOC documentation and sub contractors also aren't adequately documented, there's no information on who is being used, and where they are located. (Again in regards to data outside the EU)
- EU Data Boundary and flex routing is also woefully inadequately.

So until those elements are properly documented by Google, I wouldn't expect any lawyers to accept the usage of Gemini with students inside the EU.

[marcusdstein]

This is the insight I’m looking for! @Justin_W I love the point you make about my leadership having more of a “Google” or cloud issue rather than a Gemini issue. It’s the same data protection as the core Google apps. It doesn’t train the models? So why still the hesitation? They’re willing to store all kinds of sensitive PII in sheets and in drive so… why aren’t we using Gemini with those files? 

Let’s say Gemini “touches” a sheet with PII student data in it. If Gemini falls under the same core services agreement as sheets and drive… leadership should be thrilled

but they’re not.

what they want is a very clear chart or diagram that shows what happens to the student PII when Gemini touches it? 

@Kristal is that a thing? Something created by or verified by Google engineers that clearly shows where student PII data goes when it’s touched by Gemini 

[MarkB]

The difference is that storing data is very static, you don't shift the hosting server of a document to a new location "just because".
But Google aren't willing to guarantee, that Gemini won't run outside of your designated region, so during peak hours when load balancing, data could in theory be handled in non-approved regions.

[marcusdstein]

@MarkB YOU are speaking my language. This is how my brain works and how my leadership thinks... what about the what if scenario you just presented in your comment? We must know exactly where the data is traveling

[Aziz]

Hi Marcus,

I think Google’s Privacy & Security documentation may be a useful starting point for your district’s questions.

For Google Workspace for Education accounts, Google states that Gemini provides enterprise-grade data protection. Chats and uploaded files are not reviewed by human reviewers or used to improve generative AI models.

Google also explains that existing Workspace protections, including admin controls and Data Loss Prevention (DLP), continue to apply to Gemini.

These resources may help your technology leadership team:

• Google for Education Privacy & Security FAQs

• Gemini Apps with a school Google Account

• Gemini for Google Workspace data protection

I’d also be interested to hear how other districts are translating these protections into practical policies for teachers and students.

Hope this helps!

[henryrobert]

Protecting personally identifiable information in Gemini is an important topic, especially when AI tools are used in education. Clear controls for detecting, limiting, and handling sensitive student information would help schools and users better understand what data is protected and how it is processed.

[MarkJLoundy]

The only safe policy is a blanket ban on student PII in LLMs.