Workspace has published policies about how the customer's data may be used: https://support.google.com/a/answer/15706919
> Your content is not used for any other customers. Your content is not human reviewed or used for Generative AI model training outside your domain without permission.
And I think the default assumption has to be that those policies are actually followed. If you think they aren't, the burden of proof is on you to show they aren't.