Even if your business does not use Google applications – even if you intend not to use Google applications – Google’s new privacy policy and terms of use could give Google scary rights to your content. Any business with employees who may use Google (which is to say, any business) is at risk for:
Google's new Privacy Policy and Terms of Service, scheduled to take effect March 1, 2012, have gotten a fair amount of press. You’ll see why if you click through to Google's “Policies & Principles” page. There, Google brags about their “new policy” that “covers multiple products and features, reflecting our desire to create one beautifully simple and intuitive experience across Google.”
The desire for beauty and simplicity may be one driver for Google's new policy. But there are plainly other motivations at work. Google wants your data. Indeed, no person, whether an individual or a body corporate, should expect to retain control over personal information or content provided to or stored with Google.
But businesses have special risks of potentially catastrophic exposure. Under Google’s new policy, even employees’ unofficial or unauthorized use of Google services could compromise confidential information and important intellectual property rights.
In fact, businesses should make clear to employees that Google services (and probably many other cloud services) may not be used on behalf of the business, or for business purposes. Why? Because, according to Google, “If you are using our Services on behalf of a business, that business accepts these terms.” Not only that, when you “upload or otherwise submit” content to Google, you give Google “a worldwide license to use, host, store, reproduce, modify, create derivative works . . ., communicate, publish, publicly perform, publicly display and distribute such content.”
This is a frighteningly broad license. Don’t take too much comfort from the proviso that the license is “for the limited purpose of operating, promoting, and improving our Services, and to develop new ones.” And don't count on your lawyer showing that content was not posted “on behalf of” the business. If you, or your employee, put confidential information into Gmail or a Google document, and Google decides to share it with the world to “improve or promote service,” you may be out of luck. Moreover, one of your employees acting unbeknownst to, and unauthorized by, management could compromise your company simply by using Gmail for important company documents, or by putting company information in a Google document. And if you think Google is asking for no more than any other provider of free cloud services, think again. (For example, see the terms of use offered by another popular cloud provider, Dropbox.)
Google's new policies present a host of other concerns. For example, Google tells you that it is presenting a unified, simple policy for all of its services, but then walks it back: specific services may have specific policies associated with them. Even if you get past your discomfort with Google's new policies, you may be subject to other policies for certain services that make you even less comfortable. And here I will stop; what should be apparent is that use of Google's services for business purposes presents a minefield.
Google’s services are free, and they work well. Google offers a bargain that may make sense for many individuals. But businesses need to guard against the real risk that use of Google will mean losing control of key secrets and intellectual property. Consider whether you need to instruct your employees to forego use of Google web services, and maybe even enforce these policies by restricting corporate access to Gmail and other Google services, as some companies already do. Unfortunately, in the digital age, sometimes the draconian policy is the common sense policy.