3

I am trying to solve a compliance issue with a vendor that uses Google Cloud with Customer Managed Encryption Keys (CMEK).

The vendor stores personal data in Google Cloud and claims that CMEK makes sure that Google can't decrypt the stored data and access it. Is this true?

From what I can read (from Google's vague documentation), CMEK gives the customer more control over the keys, but Google still have access to the key (and therefore data) and I don't see how this is different than normal at-rest encryption from a Compliance (Schrems II) point of view.

Feel free to link documentation along with answers. I don't see a lot of literature on the subject.

(I am EU based and in a company that have a "worst-case-scenario"-mindset when it comes to transferring of data to Unsafe Third Countries. We do not want data (unencrypted) outside of EU/EUA)

Improve this question
2
  • We can provide a technical difference, but we can't provide an opinion on how Schrems II might view it.
    – schroeder ♦
    Commented Oct 13, 2022 at 11:07
  • @schroeder A technical explanation of what kind of access Google has to data in a CMEK-setup would be really beneficial. If i understand CMEK correctly then Google still have access to decryption keys, just like normal at-rest encryption.
    – oilyhiccup
    Commented Oct 13, 2022 at 11:27

1 Answer 1

Reset to default
1

I agree with your assessment that CMEK still provides Google access to the key. Although I think it would take extraordinary circumstances for Google to access the data it "could" happen. The blog listed in the references below states it similarly:

Bring Your Own Key (BYOK) allows enterprises to encrypt their data and retain control and management of their encryption keys. However, some BYOK plans upload the encryption keys to the cloud service provider infrastructure. In these cases, the enterprise has once again forfeited control of its keys.

That blog points out that Google has a Hold Your Own Key (HYOK) service called Cloud External Key Manager (CEKM) which allows you to generate and use keys outside of Google Cloud.

Regarding Schrems II, I'm not a lawyer. Google provides details of their GDPR compliance and instructions related to ensuring GDPR protections in their cloud.

I do believe there is concern about even encrypted data leaving the EU though,

The Court stressed that protective contract clauses are not binding on third parties or authorities and therefore likely to be ineffective, while cryptanalytic and quantum computing efforts of intelligence agencies raise concerns about the effectiveness of protective technical measures such as encryption

References
cloud data security who should hold keys
Google Cloud GDPR

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .