Google and Your Business – Is There a Google Privacy Problem?

Rob Borley
on 16 February 2014

As Cloud software matures and businesses look for ways to reduce costs, many are looking at replacing their productivity suites and email systems with Google Apps. On paper, the offer of cut-price software replaces the more costly Microsoft Office applications seems perfect for cash-strapped companies.

The option of shifting corporate email to a hosted, Gmail solution, can further reduce costs, allowing the company Exchange servers to be retired too. And Cloud storage can be used to reduce the corporate data center and facilitate easier access to data.


So far so good, and with many organisations coming to Dootrix to discuss Android mobility rollouts as well, is everything quite as it seems?

The PRISM effect

The revelation that the US government has been spying on businesses and individuals with the apparent assistance of major IT vendors has become a source of concern for those being monitored. The fact that NSA activity has crossed international borders shows that intervention in this way affects all businesses, regardless of where they may be headquartered.

Google has recently protested about secret government “snooping”, joining with other industry bodies to register their discontent with the current situation. However Google’s own data analysis activities are not dissimilar to those against which they protest. In reality, the only difference is that Google inform users via a clause in their Terms of Service.

The Google Clause

Under the section headed ‘Your Content in our Services’ users agree to the following (emphasis mine):

“When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide licence to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes that we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights that you grant in this licence are for the limited purpose of operating, promoting and improving our Services, and to develop new ones. This licence continues even if you stop using our Services (for example, for a business listing that you have added to Google Maps). Some Services may offer you ways to access and remove content that has been provided to that Service. Also, in some of our Services, there are terms or settings that narrow the scope of our use of the content submitted in those Services. Make sure that you have the necessary rights to grant us this licence for any content you submit to our Services.”

For individual users, this may not present too many problems. For businesses bound by non-disclosure agreements (NDA) or who are relying on Google Drive Cloud storage space to host commercially sensitive information, the terms are more concerning.

Serving ads based on the content of emails is one thing, but reserving the right to create derivative works is quite another. At present Google claims such rights for improving the service they offer to Apps users but is loose enough to expand the definition at any point. Under the terms of service Google could use content stored with them to create new products and services, even though your business retains the ownership and intellectual property rights.

Creating a business headache

Strictly speaking, storing NDA-protected content in a service where you know the content is routinely accessed by a third party is a breach of that agreement. Should something go wrong, or the content be used for an unforeseen purpose by Google for instance, where does the blame lie?

There is also the not-so-small matter of data retention. The licence granted in the Terms of Service is perpetual – Google reserves the right to retain a copy of all data stored in their apps. Anything already saved in Drive for instance is available for further analysis or exploitation at any point into the future.

Mobile Computing is also affected

For maximum productivity, or to access core Google services, Android smartphone and tablet users also require a Google account. Content stored using Android devices is thus subject to the same Terms of Service and usage by Google.

Even if a business chooses not to use Google Apps, an Android roll out may present the same issues regarding data privacy and ownership. The cheap price of Android hardware could come at a significantly higher cost in the longer term.

Nothing wrong with Google privacy. Yet.

At present there is no indication that Google are using their data mining efforts for anything other than targeted advertising. However Google has reneged on “cast iron” promises in the past (homepage banner ads for instance), so there always remains the possibility that the definition of “service improvement” could be modified in future.

The Google ToS is unique in its claim to license rights to content uploaded by service users. And it should also be a point of serious consideration for businesses considering a move to Google Apps. Second-guessing Google’s future actions may be considered paranoid, but when data is the second-most valuable asset to a business (after its employees), such concerns are rarely misplaced.


Subscribe to our newsletter for free advice delivered to your inbox on a fortnightly basis.

Related articles