How secure is it to store information in Google products

Question

I think many people have been gradually forking over more and more personal information to Google. I was noticing how I now have details about my doctor appointments stored in Google Calendar and on Google Drive I have some phone calls recorded from my phone. I'm not sure if the folks at Google actually view the data but what about third party apps? I wanted to know the size of a folder in Google Drive and it turns out I have to use this app which needs to "view and manage" files on Google Drive. So would allowing this basically be like giving my medical history to some random person?

Are there any resources that explain what the different permissions are?

Answer 1

Unless you encrypt all data on the client side, the answer is as easy as: Anything you store with Google is not secure at all, even more so (but not exclusively) if you use third party apps to access the data.

Any app that you use and give access to your Google account can do pretty much anything, from working as you expect to reading and modifying files, or sending your confidential data to someone else. You do not have an easy way of knowing. You'll have to trust the author of that app.

(All of the above is not very particular to Google, however. It applies to every other provider as well.)

As for general security, not only could Google employees in theory read (and modify) any data or deny you access to your data at any time since it's stored on servers that are not under your control (not all Google employees have that level of access, but a considerable number certainly does).
Also, Google will most certainly run automated "data mining scans" over your data. They're a company that makes a living from collecting data and delivering custom-tailored ads as well as selling data (of some more or less unspecified kind) to other companies.
It is not publicly known what methods exactly are applied and what data is collected (anonymized or identifiable) and how much data is stored, nor how exactly it is used. However, it is certain that this is happening (unless they changed their ToS since I last looked, you are agreeing to that, too, by using their service).

In addition to that, Google is an US-based company, and like every US-based company they will deliver your data to governmental agencies without hesitating, and they will neither make this public nor admit to you or to anyone else that they're doing (or have done) it, being bound by what is called "National Security Letter". The nature of a NSL is basically the same as what ordinary blackmailers that are not a governmental agency are doing by telling you "No police, or your child dies".
Except in this case, the threat is something like "Your company shuts down, and you go to jail without trial".