Google to add more Workspace data transfer controls in Europe

Google has announced a set of new data transfer controls for its Workspace productivity suite, which will be rolled out in Europe starting this year.

The controls will enable organisations in both the public and private sectors to "control, limit and monitor" transfers of data to and from the European Union, according to the tech giant's blog.

Heightened legal risk around the export of personal data appears to be the motivation behind the changes, with landmark EU rulings in 2020 heavily affecting regional use of US cloud services. It is certainly the reason behind Google's "Sovereign Controls for Google Workspace" terminology, which seems to have been directly taken from the "digital sovereignty" that EU lawmakers referred to.

The new controls will start rolling out at the end of 2022, with additional capabilities to be delivered throughout 2023. Google said it will build on its commitment to "Client-side encryption", "Data regions", and "Access Controls" capabilities.

"European organisations are moving their operations and data to the cloud in increasing numbers to enable collaboration, drive business value, and transition to hybrid work. However, the cloud solutions that underpin these powerful capabilities must meet an organisation's critical requirements for security, privacy, and digital sovereignty," Google's VP and GM of Workspace, Javier Soltero wrote in a blog post.

"We often hear from European Union policymakers and business leaders that ensuring the sovereignty of their cloud data, through regionalisation and additional controls over administrative access, is crucial in this evolving landscape."

Organisations can opt to use "client-side" encryption, according to Soltero. It is now generally available for Google Drive, Docs, Sheets and Slides, with plans to extend it to Gmail, Calendar and Meet by the end of the year.

Beyond that, the tech giant is also expanding data location controls by the end of 2023 and more access controls. This will include capabilities to restrict or approve Google support access through 'Access Approvals". The ability to limit customer support to EU-based staff through 'Access management and functions to generate "comprehensive" log reports on data access via an Access Transparency feature.