Why not? I don't think that's an issue if the actual data is already sitting on a third-party cloud in some middle-of-nowhere undisclosed location or being transited through various other cloud services, right?
Depends on the data, but everyone should be treating metadata at the same classification level as the underlying data. Perhaps even moreso, as metadata leaks information about the company, versus leaking data about the user. (Rightly or wrongly, things that harm the company are more likely to be prioritized.)