Frankly I'm surprised its without permission. Throw that shit in the ToS right next to the part about Google having permission to kiss my mom whenever they want - nobody's going to read it and the TOS for Google drive already allow them to look at user content.
They should blame the AI, saying it's going rogue, but without citizenship we can't prosecute the AI, so we should give them citizenship, and then suddenly we are equals, lol!
That the person who reported it used a ML to try and find the setting to attempt to solve it, did not fill me with confidence of their abilities to manage this. They later admitted that they did have it enabled in some form.
They also never became specific about how well Gemini interpreted their tax result file. Did it give the proper number verbatim? That's pretty damming. Did it just reply "You're not getting a tax return"? That's just 50/50 odds.