4

If for your job you use any Google services, chances are you are sending them a lot of personal data of your clients in emails, documents, etc. So technically you are the controller, and Google becomes one of your processors. Is Google's current privacy policy compliant with GDPR and also valid as the data processing agreement (DPA) between a controller (you) and a processor (them)? If not, then I guess it's illegal to use Google's services for professional purposes. If it is compliant, then I'd like to know what parts of their policy actually make it a valid DPA.

Edit: I just noticed that GDPR and DPAs are mentioned in the privacy policies of some of their products, like G-Suite and Google Cloud Platform, but I don't think this is valid in general for the privacy policy of all of their services, especially their free services. I'm sure there are millions of people who use at least one of Google's free services as part of their jobs, by the way.

Improve this question
1
  • 1
    You're right, people do. Google only get behind it and call themselves a processor when you pay them. The only way to be compliant when using free tools like Drive to process personal data within the scope of the GPR is to pay for G-Suite.
    – Sam_Butler
    Commented Nov 19, 2019 at 17:06

1 Answer 1

Reset to default
2

Google has many different products and product tiers, and offers DPAs for some of them. E.g. Google does offer DPAs for business-oriented products like Google Workspace (formerly GSuite), Google Analytics, and Google Cloud. They do not offer DPAs for consumer-oriented products such as their free Docs and Gmail offerings. Even within paid offerings, Google may sometimes act as a data processor and sometimes as a data controller, enabling them to use collected data for their own purposes. Care has to be taken by admins to disable unwanted features in order to achieve GDPR compliance.

Even when Google offers DPAs, that might not be sufficient to achieve GDPR compliance. Since Google does not guarantee the location of data (except for some Cloud products and higher Workspace tiers), international transfers are involved. International transfers of personal data into the US are not generally legal following the 2020 Schrems II ruling.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .