You're thinking about this very much from a techy point of view.
We have a similar value prop with our platform (we store PII including actual identity documents).
It's not about making it impossible for users to download and store sensitive data. Everyone knows that that's impossible - yet somehow Snapchat and its disappearing messages is still a thing.
Instead, it is intended to be coupled with policies. As long as the company has a policy against downloading/storing confidential information, then the company is covered.
Then, when a case of e.g identity theft happens through a rogue employee, the company can demonstrate that it has taken all reasonable steps to avoid it.
That is a much better position than showing up in court and saying "yeah, we didn't try to prevent people from downloading PII, that's impossible anyway".
This is exactly right. It doesn't stop espionage or a rogue employee - it is not supposed to; but it does stop inadvertent duplication all over the place in ways the company could be liable for due to inaction or insufficient policy around PII, etc.
Not every employer hires folks like you who go out of their way to print confidential emails so they can violate customer privacy.
MANY employers have folks who unless you put a speed bump in their way would have employees inadvertently sync their entire email history onto their kids computer or a random computer while traveling.
The ENTIRE POINT of MANY of google's settings is to allow for those railings to be put in place. This is so employees who aren't out to abuse data can go about their day with reduced risk of inadvertently screwing up.
This is a big risk factor (I'd argue a much bigger risk factor than intentional employee misbehvior).
Additionally, once these controls are in place you can actually drive even better security where needed - it is possible to do a USB / printer / no phone lockout for high security ops - and is done when needed (very rarely). Thin clients are actually popular here - remote desktops another layer making it harder to dump the x million records out of system.
I don’t think it’s fair to jump to the conclusion that management at the GP’s see their employees as malicious. It’s far more plausible that they just don’t want emails automatically downloaded and stored on everyone’s computers.
Many companies have strict regulations on data retention and they’re regularly audited to ensure compliance. By keeping the data off employee computers, compliance is simplified.
I'm assuming your employer has never heard of printers or copy-paste. ;)