Alice is a data subject, Bob Inc. is a data controller processing her PII, both located in the UK. In responding to a subject access request, Bob Inc. sends some PII in plain text in an email. Examining the headers Alice finds that the email has gone via the US, apparently Microsoft's servers perhaps because Bob Inc. uses their mail service.
Has an international data transfer taken place such that CHAPTER V of the GDPR applies?
An email hop? Probably not a transfer. A data controller using an US-based email service? Very likely to be a restricted transfer.
The ICO's guide on international transfers explains that there must be a recipient in the target country in order for something to be a Chapter V transfer. One of their examples is relevant:
Transfer does not mean the same as transit. If personal data is just electronically routed through a non-UK country but the transfer is actually from one UK organisation to another, then it is not a restricted transfer.
Example: Personal data is transferred from a controller in the UK to another controller in the UK via a server in Australia. There is no intention that the personal data will be accessed or manipulated while it is in Australia. Therefore there is no restricted transfer.
But just because the it's not an international transfer doesn't mean this plaintext email is legal. Regardless of whether data is being transferred internationally, the data controller has an obligation to implement “appropriate technical and organisational measures to ensure a level of security appropriate to the risk” (Art 32), in particular encryption if it is appropriate. But whether and which kind of encryption is appropriate depends entirely on context.
Your question suggests that “Bob Inc. uses [Microsoft's] mail service”. Then, things are more difficult. We can't necessarily argue that the email is just being routed via an US-based server. It is probably more correct to argue that the email service is acting as a data processor on behalf of Bob Inc. Since there's now a US recipient that performs processing of the email (such as storage on these servers), a transfer would have taken place. Then, Bob Inc as the data controller and data exporter must safeguard this transfer. The EU–US Privacy Shield adequacy decision was invalidated (before Exit Day) and Standard Contractual clauses are not sufficient by themselves. However, the ICO is in the process of writing guidance on new International Data Transfer Agreements (IDTA) that can be used in place of the old SCCs.
