The article is very vague. It would be interesting to also have a link to the full study/paper, to get a better picture.
FWIW, at least on the teaching/TA side, Dutch universities have already been careful when storing student data to the public cloud due to GDPR [1] compliance issues. In my previous affiliation, we used to create one-off mappings for each course, assigning each student a pseudonym. Any data processed on the public cloud (typically Google Docs) were using only the pseudonym, so the students couldn't be identified. The mapping file was maintained on private cloud (typically SURF [2]).
But of course, this would all go to waste if after registering the grades, they would be stored on the public cloud in some other form. That's not happening AFAIK, but I've been out of the loop for a couple of years.
[1] https://www.gdpr.eu/
[2] https://www.surf.nl/
