> I think a much better question would be "how are information security and privacy controls implemented"

I don't work for Google, but if I was asked that question, I'd be afraid of giving an answer that would violate my NDA. You'd probably get a vague answer like, "Those policies and processes do exist, but I'm not at liberty to go into them right now. Why do you ask - is there something specific I can address?"