First, all your data at rest, on disk, is encrypted. You can even supply your own keys if you wish: https://cloud.google.com/compute/docs/disks/customer-supplie...
If you are using Google Managed keys, the keys are stored in a special key storage service. To access your files, a staffer would have to read the keys, then go and read the data and decrypt it. Both of these steps are extremely logged, and require Googlers to take particular, and specific steps that are audited and easy to spot (and we audit this all the time, proactively). And not every Engineer (and no non-engineers) has the access to even get to that.
Accessing user data, in any form, is a very fire-able offense, and people have been terminated over it.
Our internal controls are very robust. We spent a lot of resources on encryption and ensuring it's available at many different levels. This is one area where I feel Google Cloud is better than bare hardware, the on-disk encryption is default and cannot be turned off.