Security of Google Forms and GDPR

[NotAllThere]

My wife recently received an email with a link to a Google Form, from her employer's HR person. The form requests certain sensitive pieces of information. There's no particular issue with providing the data, as such, but the method doesn't seem quite right. (I'd prefer she receive a form by post that she fills in and snail-mails back. Or even receives it via email to print off and post).

One obvious point is that anyone with the link could fill in any information about anyone, so in terms of ensuring data fidelity, it a bit crap.

Are there any security experts (or contractors posing as one ) who can tell me if there are any other security and/or legal issues here.

[northernladuk]

Could your wife ask her HR if these forms have been included in their GDPR preparation? Most decent companies appear to have a GDPR function desperately trying to get ready for May. If these forms have been through their process you should have better assurance than finding out they've not been looked at yet?

You seem to be asking more about security element than GDPR though?

[NotAllThere]

More concerned with the technicalities of security, yes. GDPR violations are an optional extra. The employer being a school, there's a high chance that their IT systems might not be compliant (although GDPR doesn't became law in CH until 2019).

[darrylmg]

More concerned with the technicalities of security, yes. GDPR violations are an optional extra. The employer being a school, there's a high chance that their IT systems might not be compliant (although GDPR doesn't became law in CH until 2019).

Might be good to know in which country that data is being stored and processed.
For example, would you be happy if it was stored in AWS in some country that had no GDPR regulation?
Would you be happy if it was processed in some country that had rather less secure requirements around personal data?

I don't know what obligation the company has, for providing you with this information. I'm not a GDPR expert or even remotely close. I do share the same concerns when I fill stuff in online. I especially hate those companies that make you create an online account just to buy stuff (not like Amazon, more like one-time purchases from, for example, cheapgardenstufftoyou.com).

[SueEllen]

More concerned with the technicalities of security, yes. GDPR violations are an optional extra. The employer being a school, there's a high chance that their IT systems might not be compliant (although GDPR doesn't became law in CH until 2019).

The school needs to be asked simple questions like - How many people in the company have access to the HR Google account? Does the account have at least 2 factor authentication on it?

Plus - https://support.google.com/googleclo.../6056694?hl=en

Edited to add - loads of people ask these questions of Google so they have prepared answers.