Google continues to be the data controller and data processor for most matters even if someone attempts to follow good practice of privacy

John seeks legal help from a lawyer for a case which involves sensitive information such as medical history.

John sends all PDF files encrypted with strong passwords via Protonmail.

The lawyer's firm uses Gmail as the email provider with custom domain, and uses Google Drive for backup. The lawyer is not a tech-savvy and hence decrypts the PDF files via "Print to PDF" function and subsequently unknowingly uploads the unencrypted PDF contents to Google Drive for backup, despite the explicit …

data data controller google practice privacy processor