Employers can only transfer data outside the GDPR under strict conditions. As described in GDPR Chapter 5: Transfers of personal data to third countries or international organisations, these are:
- A transfer of personal data to a third country or an international organisation may take place if the EU Commission has decided that the third country or the international organisation in question ensures an adequate level of protection. Ask your employer to provide you with information on whether your data is moved outside of the GDPR zone. Check with them or the EU whether this country has received an adequacy decision.
- Failing an adequacy decision, the employer can move data if they fulfil the requirements in GDPR art 46. Your employer must provide “appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available”
This means that there must be clear workers’ data rights agreements, that you can use these rights and that you know about them. Make a note of this and ask management about these rights and safeguards. - Data can be moved if binding corporate rules in accordance with the consistency mechanism set out in Article 63 have been approved by a competent supervisory authority (GDPR art 47). Note all your rights as stipulated in the GDPR must be respected, including on the right to information. In other words, you should 1. know about these binding corporate rules, and 2. ideally be part of governing them.
- Note article 49 GDPR Derogations for specific situations Failing articles 45 (3), 46, and 47 the employer can move data to a third party outside of the EU if 1 of 3 conditions is met. Condition 1 relates to you:
“the data subject (the worker) has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;”
If you have not given this explicit consent, the moving of data under this article and failing articles 45 (3), 46, and 47 is unlawful.