Should we store personally identifiable information on google drive?

Question

For a number of reasons, including remote accessibility, my company would like to move all of our accounting records, account applications, and marketing materials to Google’s Apps for Work Drive. At first glance, this sounds like a pretty bad idea, but I don't have the firsthand knowledge or reasons to argue a case against it.

The information stored includes banking information, names, and addresses; as well as SSNs, mostly in the form of PDF documents.

Can we legally host our files with Google Drive, who would be responsible for the costs associated with a breach in access, and is the amount of risk worth the increased accessibility?

Documents provided by Google support:

• Security and Compliance Whitepaper
• Certifications Summary
• Audit & Certification Summary
• Certificate
• HIPAA Business Associate Amendment

Answer 1

Google Drive is no more or less safe than any other web-based service with a single logon. Your company must decide for itself whether it is willing to put the data online (albeit behind Google's authentication)

At the very least, I'd recommend that

1. 2-factor authentication is used
2. Any data travelling outside the organisation is encrypted.

Google Drive is presumably fairly secure, but as we saw with iCloud, people can (and do) sometimes get access to systems they shouldn't be able to access.

One piece of advice a tutor at university gave me was:

Treat anything that isn't behind your firewall as though it was on a USB pen you'd just left on a train

Meaning: assume that it may fall into the wrong hands, and ensure that you've taken sufficient precautions to make it useless to them.

(In fact, I'm a fan of treating things that are behind my firewall the same...)

Edit

To add to the "liability" question:

This is mostly a matter of what is stated in the contracts, agreements (EULA or ToS etc) etc between you and Google, and potentially you and any third parties who the data belongs to. Note that this doesn't just include clients/customers, it also includes your staff, if you are storing their personally identifiable information in the cloud - so this could not only cause financial issues, but also destroy employee trust if there is a breach! Your bank may also refuse to reimburse any money lost if bank details are stored in the cloud, as this could be considered negligence.

In general, though: unless specifically stated, at least some liability will always remain with you. Some liability may or may not fall upon Google for data breaches etc, but this will depend on the agreement. You will still be liable for any third party data, however, in as much as you have chosen to entrust it to a third party.

If there was a data breach, it would then become a (likely very long and drawn out!) legal question, and would revolve around whether either Google or yourself were negligent, the nature of your agreement, and whether you both took any and all reasonable steps to protect that data.

I think the crux of your question is "Will Google take responsibility for the security of data on Google Drive" to which the answer is "No, probably not". But I am not a lawyer, nor do I play one on TV.

Answer 2

This answer may not directly relate to your question who is held liable for data leakage.

I would not store any unencrypted, sensitive data on google drive, even if they just use your data to operate, promote and improve their Services. From Google's Terms of Service:

When you upload, submit, store, send or receive content to or through our Services, you give Google (and those we work with) a worldwide licence to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes that we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights that you grant in this licence are for the limited purpose of operating, promoting and improving our Services, and to develop new ones.

Answer 3

Storing sensitive data outside of a private network is always a risk.

It's much more easy for malicious users to get access to the data. Using fishing techniques, or if you log on your account on an infected computer, or even worse if your computer gets infected a malicious user could get access to your credentials and use them to access the data. Since Google servers are available on the web it wouldn't be hard to connect and do some damage.

On the other hand if you keep the sensitive data in a private network it's always harder to access the data even if the malicious users have the credentials, because they would have to enter your network first.

To help avoiding situations like that, a two-factor authentication is allways recommended. Unless the malicious user could have access to your physical device, the two-factor authentication would make it harder to access the data even with the credentials.

Another important aspect is the way you storage the information. I'd recommend to store the information encrypted (you can try Truecrypt) because that way even if somebody could get physical access to device or for some reason could log and see the data it would be unreadable.
And the Google policies for uploaded data allows them to use the data for multiple purposes (like advertising, translations, etc), so you never know.

Answer 4

I'm making the assumption they would be responsible for physical breaches ...

I doubt that they will be responsible for this in the way you expect it. Especially I doubt that they would cover all costs caused by the loss or leak of these data. Unless they explicitly cover thus costs it is primarily your problem because you've uploaded the data there.

You might check with you cyber-insurance provider if they would cover thus costs (I hope that you have such an insurance if you deal with such sensitive personal data).

Answer 5

Encrypt the data no matter what! Sensitive data should not even be sitting within your own network without being encrypted and access control in place. If it's encrypted in the first place you at least have a lot less to worry about in any circumstance. Don't trust someone else to do the job you should have done in the first place and it's more about protecting yourself. Depending on the data you transmit it could be illegal to transmit and store it un-encrypted. And it should never be outside of the company un-encrypted. If you must do something like transport it on a laptop or flash drive, those devices need to be encrypted. You lose the data for improper practices its your fault.

Answer 6

Why not set up your own server in your company? My father in-law worked in an accounting firm and set up their own servers for their data.

Answer 7

It was revealed at this years DefCon that there's a new kind of attack vector being used called MITC, or Man-In-The-Cloud, that has already compromised several G-Drive and DropBox accounts. I would STRONGLY advise against this.

Answer 8

In addition to the above comments, I'd add a small tidbit. The vast majority of the cloud storage providers do not encrypt the data "at rest" on their servers for their "standard" consumer offer. There is a HUGE notable exception to this and this is "Box" (not Dropbox, just "Box"; they are at box.com). They are not as cheap as Google Drive, but there is some value in the fact that the data is in fact encrypted at rest. This could alleviate some of the challenges with encrypting it yourself before you store it in the cloud.

Additionally, their service does have a HIPAA-compliant variant that should more than satisfy concerns about data protection.

See more here: Box Security and Privacy (click the Encryption tab at the top for more specifics)