Create & Share Files

Google Drive is a great tool for collaboration on files with other people. However, with more people working on a file, there is a greater risk that the file will accidentally be shared with the wrong parties and information could get into the wrong hands. Therefore, whenever you share a Google Drive file with other people, please review the following check-list to make sure you are protecting your shared documents:

• Verify you are sharing with the correct email address before sharing. Learn about how to share files and folders.
• If you give someone permission to edit a document in Google Drive, they can share the file with other people. Ask those who you share with to be cautious when re-sharing. Learn how to prevent re-sharing.
• Remember, whomever you share with can create a copy of your document, even if you only give them permission to view your document. Learn how to prevent others from copying, printing, or downloading your document.
• Use “Link Sharing” with caution. When you enable “Get shareable link” by default “Anyone at BC with the link can view.” If you think there are people at BC who should not have access to view the file, do not use this feature. Instead, share with individuals only.
• Share folders cautiously. When you share a folder with someone, they then have access to all the files in the folder. Only share a folder if you are certain all files in the folder can also be shared. 
• Revoke sharing rights when they are no longer needed.
• Periodically, verify security permissions on secure documents. Learn how to see who has access to a document and change your sharing settings.
• When you share a Google Drive link in an email, you may receive this pop-up (image below). Do not select "Share & send." This feature will share the file with "Anyone at BC with the link." Instead, select "More options" to share the file with the email recipients only.

BC G Suite for Education and consumer, free Google services are not the same.

BC G Suite for Education

• BC has an agreement (contract) with Google for a specific instance of G Suite that is different than the user agreement for consumer/public Google services.
• BC G Suite for Education Core Apps includes Gmail, Google Drive, Google Calendar, Google Sites, and Google Contacts. These Google Core Apps are covered by the contract Boston College has with Google.
  
• The agreement provides that all of our data is deemed to be confidential information and may be used by Google only for the purpose of providing the services and meeting its obligations under the agreement. BC user data stored in G Suite for Education will be handled in adherence to our standard compliance practices for FERPA, etc. and users will not be subjected to advertising.
  
• Boston College owns this data, it is not indexed by Google for advertising purposes, and there are no ads.
   

Consumer Google Apps

Any personal Google account you may have is covered by different “terms” and may not have the same security and privacy agreements as BC G Suite.

• Picasa, YouTube, Blogger, Maps, Photos, and numerous other Google owned services are not part of BC G Suite, and therefore have different user terms.
• When you access other Google services you agree to Google’s consumer user agreements, which are quite different than the BC G Suite for Education agreement.
• Google Consumer Apps are covered by the Terms of Service between YOU and Google. 
• Google Consumer Apps do not necessarily offer the same accessibility, FERPA, privacy, intellectual property ownership, and confidentiality terms and conditions as when using Google Core Apps.
• These optional apps have the same privacy policy and terms of service that apply to Google's Consumer products. 
• Data created while using these apps is not owned by Boston College, is indexed by Google, and may be used for advertising purposes. Use at your own discretion.
   

The BC Data Security Policy defines three categories of data: Public, Internal Use Only, and Confidential.

The Data Security Committee, General Counsel, and the university’s FERPA officer have informally agreed that an additional, 4th category of data will be added to the Data Security Policy that is even more sensitive than “Confidential.” Data that falls in this additional category will not be allowed to be stored off-campus except with written permission (see below). Google Drive is off-campus, and thus data that falls in this category must not be stored on Google Drive.

Important: Due to constantly changing regulatory and grant changes, please consult with your Data Security Officer (DSO) to determine the safest place to store your confidential data.

Until a formal policy revision is made and approved, you should use the following as a guideline:

• Restricted. Due to legal restrictions or security concerns, some legally protected and highly sensitive information must not be stored on G Suite or other “cloud-based” systems without permission of the responsible Vice President or the Provost’s Office. This information, much of which was formerly classified as “Confidential,” includes:

  • Social Security Numbers

  • Financial or credit account numbers

  • Personal financial information (e.g. financial aid data)

  • Account log-in credentials

  • Driver's license number or state-issued identification number

  • Health and medical records, including HIPAA-protected information

  • Export-controlled information

  • Human-subject research information

  • Other sensitive information that the information sponsor or responsible Vice President has determined must remain on a secure BC server.

• Confidential. FERPA data (e.g., student records) is generally defined as Confidential, and can be stored on BC Google Drive, except as noted above. Other Confidential data, except as noted above, can also be stored on BC Google Drive.

• Internal Use Only: Acceptable to store on BC Google Drive.  

• Public: Acceptable to store on BC Google Drive

For more information, contact security@bc.edu.

Important: When sharing confidential data electronically it is important to ensure it is secure. We strongly recommend you review the Regulated Data Chart to help you decide where to store confidential data.