An EU employer plans to email employee HR files to a US parent company with no adequacy decision, SCCs, BCRs, or valid derogation in place. What transfer rule applies?
Select an answer to reveal the explanation.
Short Explanation
Sending EU HR files across the Atlantic without a transfer tool is like shipping valuables with no customs paperwork. Group ownership does not magically unlock Chapter V. Use adequacy, safeguards such as SCCs or BCRs, or a narrow valid derogation—don’t just hit send.
Full Explanation
Chapter V restricts transfers of personal data to third countries or international organisations unless an adequacy decision applies, appropriate safeguards are in place, or a specific derogation under Article 49 validly applies. Corporate affiliation does not exempt transfers from these rules, and the restriction is not limited to special-category data. Controllers must implement a lawful transfer mechanism before exporting HR files to a US parent lacking such a basis.