I am considering uploading some (all) of my digital personal data to Google Drive. I guess this would instantly grant access for NSA to my data. (Is that right?)
Who would have access to my data on my gDrive? After deleting some files on the Drive, will they actually be deleted?
As for deletion, Google uses a highly distributed storage system. I don't believe they will intentionally keep data after you delete it, but because of how Google's storage works, residual copies may stick around for a while.
Not instantly. Although, that's what I want to believe. What you could do is the following. Download the Truecrypt version 7.1a and create an encrypted storage file (option 1 from the wizard) and choose 3 algorithm based encryption with a SHA-512 key. Put all your sensitive files in here and upload the encrypted file to Google Drive. When you want to work with your files. THIS IS IMPORTANT: Copy the encrypted file OUT of Google Drive, perform your work, encrypt and put the encrypted storage file back on Google Drive. This should keep your data safe.
If you want to delete it, just delete the encrypted storage file, nothing they can recover without your key.
PS: Since a short time you can ask Google to explicitly wipe your search data. If you just delete your search history through your user control panel in google than it is still used for advertisement. (scumbag, I know)
Any data you upload to Google Drive (or Skydrive, or Dropbox for that matter) should be considered duplicated by the NSA. Apart from arbitrary queries from the aforementioned secret service, law enforcement agencies from any country may gain access to them through legal means (subpoenas and so on). And of course, Google engineers could in theory browse your files.
As for what happens when you delete them, who knows? It is a good working assumption to consider that any data uploaded will stay on their servers forever. Realistically, I suppose it does get deleted at some point, but considering how much replication they must have, it may be a while. Your guess is as good as mine.
Bottom line, it is not trivial to set up off-site backups for confidential data. The only thing you can trust (or hope to trust) is cryptography. Look into duplicity and other backup tools which support strong encryption!
What about hosting those files on other hosting services which have client side encryption like:
Cryptography is a form of smart obfuscation,
it does not make things "secure", just "secure enough, for now".
If someone REALLY is out to get you, he would store your encrypted data until a later date when encryption can be broken - anything from stronger computers to software vulnerabilities like "heartbleed" will do the trick to decrypt your stuff in the long game.
Also, chances are, if someone really is out to get you it would probably try to find a way to hack your computer, not your cloud account, there's plenty of such software around - some of it available to random 3rd world governments under shareware trial licenses for free.
To answer one of your questions: any Google employee who has administrative access to the hosts (file servers) on which the drive data is stored will have read-access to your data: this includes the operations engineers, service engineers, system administrators: these type of employees are typically the ones with that type of access.
The answer to your other questions depends on what methods Google uses to remove distributed data across multiple hosts, and whether they are using any backup methods to store copies of the data. Nobody other than Google technicians will know the answer to this question, and of those probably only the engineers who maintain the filers and the data distribution structure.
To give you an idea of how truly "privy" that information is: I used to work at Yahoo as a Unix sysadmin, but I didn't work with the filer infrastructure and so even I don't know what the answer to that question would be for Yahoo data, although I spent a year working in the operations group for two of the departments there.. Only the engineers directly responsible for that infrastructure are going to know if the data is truly "deleted" or not (and to what level of deletion, if that makes sense to you).
most likely, the file system pointers to the data are deleted within one or two days (depending on how long it takes to propagate through Google's infrastructure), while the actual data itself continues to reside on hard disk until it is overwritten: meaning the data (or parts of it) could theoretically (and fairly easily if someone made the effort) be recovered many months later.
Regarding other agencies or companies with access to this data? Nah .... the only way the NSA or somebody could access it is if they have employees working at Google. Unlikely. And even if they do, do they have root access on the servers in question? Not likely. As someone else mentioned, theoretically the government can get access through a subpoena process. But from a practical perspective do these people have willy-nilly access to John Anybody's data? Nah.
The only people who theoretically intercept your data when you upload it are the system administrators and operations engineers who work at the companies that provide the network backbone for the internet: such as UUNet. I know for a fact these people for many years have scanned internet traffic for illegal content, because years ago when I lived in Virginia I interviewed with UUNet for a job which involved this work. They offered the job to me, but I didn't take it because I accepted a job elsewhere at the time.
This is more of a comment than an answer, but apparently I'm not allowed to comment yet. If you're concerned about the privacy of your cloud storage, you may want to consider Tresorit as an alternative to Google Drive. It offers client-side encrypted storage & syncing, so the Tresorit engineers aren't even supposed to be able to tell what files you're storing there, let alone their contents. It's also hosted in Switzerland to take advantage of that country's strong privacy laws.
Of course, it has the same downside as all true encryption, which is that if you lose your password, there's nothing they can do to help you.
Apart from statements like NSA has your data when uploading it is based on the assumption that your data being on your disk is not somehow accessible. Like others stated, if your data is encrypted in a strong manner on your disk and uploaded in the same way I would regard the online version more safe in terms of redundancy (google is managing the replication and backup of their cloud). Stealing or breaking your machine with your data then has no effect.
If your data is not encrypted you still assume at this moment, that your data is totally secure on your disk and not accessible from the NSA. Depending on your operating system this might not even be the truth. Even if you can guarantee that your OS is free of any spyware, there is a chance that you cannot say the same for the channels through which you obtained the data. Being uploaded to google certainly allows easier access to data but I would not regard it as a "none to full exposure" in that way.
