ChromeOS

It's not even about selling it on to others in this case:

https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2024/jan/datatilsynet-giver-paabud-i-chromebook-sag

Auto Translated:

The conclusion of the Danish Data Protection Authority's decision is that there is authority to pass on the students' information for the purpose of providing the services, improving the security and reliability of the services, communication with e.g. the municipalities and compliance with legal obligations.

At the same time, however, the assessment is that the Folkeskole Act does not sufficiently clearly authorize the municipalities to pass on the students' information for the maintenance and improvement of the Google Workspace for Education service, ChromeOS and the Chrome browser, or for measuring the performance and development of new functions and services in ChromeOS and the Chrome browser.

Therefore, the Danish Data Protection Authority gives an order to the municipalities to bring the processing in line with the rules by ensuring that there is authorization for all the processing that takes place. This can happen, for example, by:

• That the municipalities no longer pass on personal data to Google for these purposes. This will likely require Google to develop a technical option for the data streams in question to be intercepted.
• That Google itself refrains from processing the information for these purposes.
• That the Danish Parliament provides a sufficiently clear legal basis for disclosure for these purposes.