Providing transparency into government requests for enterprise data
Google Cloud is committed to being transparent about when governments request our enterprise customers’ data. Today, to continue our company-wide efforts to build trust through transparency, Google published its semi-annual Requests for user information transparency report.
This version of the report represents an important step forward. For the first time, it breaks out the number of government requests Google received for Google Cloud Platform and G Suite Enterprise Cloud customer data. Last October, Google committed to publish this information in early 2020, and future transparency reports will continue to include it.
Let’s take a look at some of the data and takeaways from the report before looking at how Google is working to improve your control over, and visibility into, your data.
Key Transparency Report takeaways for customers
Now that Google is breaking out information on the government requests for data they received, Google has four initial observations. These observations are based on the total number of government requests for user information (81,785) across all of Google received from July 2019 to December 2019.
First, the number of requests targeting enterprises (282) represents a very small percentage (0.3%) of the overall number of requests they received. Second, for requests relating to G Suite Enterprise Cloud customers, Google produced data in a very small number of cases (152). In each case, they reviewed the requests to ensure they were consistent with our policies and practices outlined below, and applicable law. Third, Google didn’t produce any Google Cloud Platform Enterprise Cloud customer data in response to government requests. Finally, with regard to public sector customers, Google didn’t identify any requests that appeared to be from a national government seeking information about another national government. If Google was to receive such a request in the future, they would redirect the requesting government to the customer and object to the request if necessary.
Moving forward, they trust that this enterprise-focused information will help address questions about how often governments are coming to Google to request access to enterprise customer data.
Advocacy in support of customer control
Breaking out Google Cloud Platform and G Suite Enterprise Cloud customer data in our transparency report is part of our larger commitment to advancing customers’ control of their data in the cloud. Google also advocates extensively and litigate when necessary, to protect the interests of our enterprise customers.
Google continues to advocate for five global principles for governments to follow when making requests for enterprise data stored in the cloud:
- Approach enterprises directly
- Promote transparency
- Protect customer rights
- Support strong security
- Streamline government rules for compelled production
On the litigation side, in the United States Court of Appeals for the Second Circuit, our legal challenge to protect a customer’s right to know when its data is accessed has progressed. They recently filed our reply brief to counter the government’s arguments on secrecy and notice.
Improving technical controls in our cloud
Google believes that customers should have the strongest levels of control over data stored in the cloud. To support that mission, Google has developed industry-leading product capabilities that enhance your control over your data and provide expanded visibility into when and how your data is accessed. Some of our recent product updates in these areas include:
- External Key Manager, which is now generally available, lets customers encrypt data with encryption keys that are stored and managed in a third-party key management system that is run outside Google.
- Key Access Justifications (alpha for GCE/PD and Big Query) provides customers with a justification every time their externally hosted keys are needed to decrypt data and gives them the opportunity to approve or deny such requests.
These products provide unprecedented levels of control over data in the cloud, and Google will continue to update them based on customer needs.
Google is committed to building trust through transparency, and to helping to ensure our customers’ control over their data through legal and technical means. To learn more about our efforts, check out our whitepaper, “Government requests for customer data: controlling access to your data in Google Cloud.”
You may interested:
- IBM Power Systems now available on Google Cloud
- New system to improve data loss prevention (DLP) in Google Drive
- Opening doors, embracing change with cloud data warehouses
- Exploratory data analysis, feature selection for better ML models
- Put your archive data on ice with new storage offering
- Drive file suggestions in Google Chrome will be generally available beginning in December