I think this is a critical flaw, in this day of HIPAA and SarbOx. Any business that allows someone else to store their data (or even process it) risks personal responsibility for their officers -- and what corporate CTO is going to risk that?
I don't buy this. I'm not an expert on S.O. but I'm close to one in regards to HIPAA. As far as HIPAA is concerned as long as you have a Business Associate Agreement that clearly spells out the privacy level expected from the other party you aren't going to get in trouble for a HIPAA violation.
A Business Associate Agreement nothing to address the SOX requirements, which apply to more companies. "Google ate our documents" is not a defense to SOX filing and reporting requirements.