The launch of Google Drive is great news for teams. The pricing is competitive, and it does more than just sync files. The whole suite of Google applications is built in, but for teams with sensitive data, that’s precisely the problem. It’s worth revisiting Google’s new unified privacy policy before moving your data to Google Drive.
Google’s new terms of service took effect on March 1, so nothing changed yesterday. But, as many people have pointed out on Twitter, the following section does have important considerations for Google Drive users:
Your Content in our Services
Some of our Services allow you to submit content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.
When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content.
This is where yesterday’s oft-retweeted excerpt cuts off. Here’s the following sentence:
The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones.
The blogosphere tried to draw a contrast between this policy and the Dropbox terms of service. The difference is that Google retains the right to “communicate, publish, publicly perform, publicly display and distribute” your content. Dropbox doesn’t do that.
But this post on The Verge, for example, conveniently left out the part of the Google ToS that says: “You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.”
The meme that Google “owns” the data you upload to Google Drive is obviously inaccurate. And the policy limits Google’s use of your data to the purposes of supporting its own services. That said, Google does reserve the right to reuse your data, publicly in some cases, and it shares that access across all Google services.
The thing is, if your business already used Google Apps for email or documents, Google Drive has exactly the same considerations. But since Google Drive adds more appealing use cases for sensitive documents, such as optical character recognition in scanned documents, you should keep the privacy policy in mind before making the move.
The bottom line is this: If you don’t want Google to see it under any circumstances, don’t upload it. The only thing Google Drive changes is the temptation to upload more sensitive documents. If you’re going to use Google Drive for your business, just create a company policy that keeps this in mind.
You have to own your own cloud if you don’t want to share your data. But that’s not practical in most cases. If you’re going to use Google Drive, and you’re at all worried about Google’s access to your data, there are two additional steps you can take.
Encrypt & Back Up
If you encrypt sensitive data before you put it in Google Drive, Google won’t be able to decipher it. It can do whatever it wants with the unintelligible file you give it, but that should protect its contents from any unwanted tampering.
If your files are invaluable, you might also want to back them up. Since Google Drive syncs your files to your local machine, it does create an extra copy that’s not on Google’s servers. If you back up your machines, you’re even more protected. But for teams, you still might want an extra layer of redundancy for the whole team’s data. Spanning is one company that offers such services, and it has a bunch of free tools for little recovery functions that Google itself doesn’t offer.
