For a number of reasons, including remote accessibility, my company would like to move all of our accounting records, account applications, and marketing materials to Google’s Apps for Work Drive. At first glance, this sounds like a pretty bad idea, but I don't have the firsthand knowledge or reasons to argue a case against it.

The information stored includes banking information, names, and addresses; as well as SSNs, mostly in the form of PDF documents.

Can we legally host our files with Google Drive, who would be responsible for the costs associated with a breach in access, and is the amount of risk worth the increased accessibility?

Documents provided by Google support:


Security and Compliance Whitepaper
Certifications Summary
Audit & Certification Summary
Certificate
HIPAA Business Associate Amendment


Google Drive is no more or less safe than any other web-based service with a single logon. Your company must decide for itself whether it is willing to put the data online (albeit behind Google's authentication)

At the very least, I'd recommend that


2-factor authentication is used
Any data travelling outside the organisation is encrypted.


Google Drive is presumably fairly secure, but as we saw with iCloud, people can (and do) sometimes get access to systems they shouldn't be able to access.

One piece of advice a tutor at university gave me was:


  Treat anything that isn't behind your firewall as though it was on a USB pen you'd just left on a train


Meaning: assume that it may fall into the wrong hands, and ensure that you've taken sufficient precautions to make it useless to them.

(In fact, I'm a fan of treating things that are behind my firewall the same...)

Edit

To add to the "liability" question:

This is mostly a matter of what is stated in the contracts, agreements (EULA or ToS etc) etc between you and Google, and potentially you and any third parties who the data belongs to. Note that this doesn't just include clients/customers, it also includes your staff, if you are storing their personally identifiable information in the cloud - so this could not only cause financial issues, but also destroy employee trust if there is a breach! Your bank may also refuse to reimburse any money lost if bank details are stored in the cloud, as this could be considered negligence.

In general, though: unless specifically stated, at least some liability will always remain with you. Some liability may or may not fall upon Google for data breaches etc, but this will depend on the agreement. You will still be liable for any third party data, however, in as much as you have chosen to entrust it to a third party.

If there was a data breach, it would then become a (likely very long and drawn out!) legal question, and would revolve around whether either Google or yourself were negligent, the nature of your agreement, and whether you both took any and all reasonable steps to protect that data.

I think the crux of your question is "Will Google take responsibility for the security of data on Google Drive" to which the answer is "No, probably not". But I am not a lawyer, nor do I play one on TV.
