The University of California Office of the President (UCOP) negotiated a contract with Google, on behalf of the UC campuses. The contract UC Berkeley has in place with Google puts in place stronger protective measures around data stored and transmitted within the core apps: mail, calendar, contacts, drive, docs/sheets/slides/forms, and talk. Google consumer apps, such as Search, YouTube, Maps, etc., do not offer the same protections and are subject to Google’s standard terms of service. The main differences between services offered under UC Berkeley’s contract and Google include:
Data stored in core apps are not scanned for the purpose of displaying ads
Data stored in core apps are not accessed by non-core services
The same access restrictions to data in core apps applies to third party sites where Google is serving ads
An example of this protection would be if you sign into your bCal account, then proceed to Google Search to look for something. Ads displaying in Google Search results screen (a non-core service) will not be influenced by data in your calendar events (data in a core service).
If you were to use a personal Google consumer account, your data is not protected from sharing between any of the services offered, such as between Google Calendar and Google Search.
Google Workspace has received a satisfactory SSAE 16 and ISAE 3402 Type II audit, ISO 27018 Cloud Privacy Standard(link is external), and ISO 27001 certification(link is external). This means that an independent auditor has examined the controls protecting the data in Google Workspace (including logical security, privacy, Data Center security, etc) and provided reasonable assurance that these controls are in place and operating effectively.
For full text of UC Berkeley's contract with Google, please refer to UCOP Contract Database(link is external). Please note that to access UCOP Contract Database, your computer must be on UC Berkeley's network.