Your employer is a data controller who has engaged Google as their data processor. It is the data controller's responsibility to ensure that any international transfers of personal data have an appropriate legal basis + safeguards. Currently, Google Workspace (previously G Suite, previously Google Apps for Business) offers the following to help data controllers with compliance:
- All data controllers for Google's paid products can sign a data processing agreement that binds Google to act as a data processor.
- As safeguards for international transfers (in particular, for transfers into the US), Google offers Standard Contractual Clauses (SCCs) that can be signed.
- In the Enterprise tier, Workspace customers can select data regions to prevent data from being stored on servers outside of the EU.
While Google has also self-certified under the Privacy Shield, this mechanism was ruled invalid in the 2020 Schrems II judgement. Under the same reasoning, it is doubtful whether Google can validly enter SCCs.
What does this tell us?
- If your employer is not an Enterprise customer of Google Workspace, the emails are likely already being processed in the US.
- This may or may not be legal, depending on your opinion of SCCs post-Schrems II.
If this were a GDPR violation, this would likely be a GDPR violation by the employer who is the data controller. The data controller is responsible for ensuring compliance to its data subjects, such as its employees. The data controller is also responsible for only using data processors that make it possible to maintain compliance, and who the controller believes will fulfill their compliance obligations.
Now lets briefly consider an Enterprise tier customer, who has selected the European data region and whose employees might be accessing emails from outside the US. As you have laid out, their emails would likely be accessed over non-EU servers.
- Google Enterprise data region policies only cover data at rest, and do not prevent processing or caching of personal data outside of the EU. The data regions only apply to specific kinds of data such as email contents.
- Thus, international transfers of personal data can still occur in this setting.
- However, the mere transit of information through a country without further processing does not constitute processing under the GDPR.
- Again, it is the data controller's responsibility to find a solution (e.g. a legal basis, or not using Google Workspace). In this scenario, a solution might involve organizational measures, such as forbidding employees from accessing their work emails from outside the EU.
Note that in no case does the GDPR require explicit approval or consent for international transfers of their personal data (other than a derogation for explicit consent to occasional transfers). The data controller is responsible for selecting a legal basis for their processing activities (such as a legitimate interest in providing email accounts to employees), for providing transparent information to data subjects, for implementing appropriate safeguards for international transfers, and for selecting suitable data processors.
