The Context Notes

The Scenario Is Just the Vehicle

A return-to-work HR documentation practice that spread across the EU and a US subsidiary — and crossed a legal line in both.

What This Lab Is Really About

Whether anyone in your organization can see personal data as it moves across borders, and who is allowed to decide what to do when two countries’ laws point in opposite directions.

The real discussion is not about an HR template or a shared folder. It is about visibility and authority: who notices when a practice quietly becomes unlawful, and who has the power to make a privacy call that binds both sides of the Atlantic.

“Nobody here would ever spy on employees. We were trying to support them.”

Exactly — and that’s how it happens. No one set out to surveil anyone. The practice began as duty of care: check in after leave, write a few notes to be thorough, share them so managers stay aligned. Every step felt responsible. The violation accrued from reasonable-feeling decisions in two countries that no one ever connected. The question isn’t whether your people mean well. It’s whether anyone is watching the point where “thorough” becomes “unlawful.”

Round 1 · The Discovery

The EU table opens the folder behind the DSAR and finds managers across four countries recording health, family, and religious observations — special-category data — readable by dozens of people. At the same moment, the US table realizes the folder lives on the San Diego cloud platform, that US admins have standing access, and that San Diego adopted the same template, sweeping in California-resident and dual-role employees. Sync: the tables compare notes and discover the problem is bigger than either side knew — and that it crossed the Atlantic.

Round 2 · Delete or Preserve

The EU table feels the pull to stop processing and delete the unlawful data, with a 30-day DSAR clock running. The US table has just been told that a US employee may bring a claim — counsel imposes a litigation hold requiring the same records to be preserved. Sync: You cannot both delete and preserve the same files. Deleting in the EU could spoliate US evidence; preserving in the US could deepen the GDPR violation. Who decides — and on what basis?

Round 3 · Notify, and to Whom

Is US admin access to and data stored on US servers a reportable breach — starting a 72-hour clock? Across four member states, is there one lead supervisory authority or several? The US table weighs CCPA exposure for California residents and what to tell US employees and the parent board. Sync + authority: who owns the global decision, and must the statements made to EU and US regulators be consistent, knowing each can be discovered by the other? The clocks are running on both sides.

Default · Two Simultaneous Tables

Split the room into an EU table and a US table. Each works its own decision under its own law and clock — then the facilitator forces a sync point where the two must reconcile a genuine conflict. Neither side can act alone. This is the version that surfaces how cross-border privacy decisions actually break down: two reasonable teams, two legal frameworks, one set of records.

Fallback · One Integrated Room

If you don’t have both EU and US leaders present, the same kit runs as a single global leadership team, with the facilitator voicing the other side’s moves and the regulators’ demands. Same scenario, same decisions — staffed for the room you actually have.

When a well-meaning practice spreads across borders, who is accountable for noticing it crossed a legal line — and in which jurisdiction?

Do your EU and US teams actually know what personal data the other holds, hosts, or can access about the same people?

When GDPR and US obligations point in opposite directions — delete versus preserve — who has the authority to make the call that binds both sides?

Group Data Protection Officer — opened the folder, owns the GDPR exposure, and the 30-day and 72-hour clocks.

EU HR Director — rolled out the return-to-work template. Meant to help. Now, the origin of the problem.

EU General Counsel — supervisory-authority strategy, which leads the regulator, and what goes in writing, while facts are moving.

EU Managing Director — runs the European business and never knew the folder existed.

US General Counsel — CCPA/CPRA exposure, the litigation hold, and US employment risk.

US HR Lead — adopted the EU template locally; owns the US employee relationships that are about to be affected.

US CISO / Head of IT — hosts the platform, granted the admin access, and just learned EU special-category data has been living on US servers.

US Subsidiary President — runs San Diego and answers to the parent board.

The open question above both tables: there is no single named person whose job is to make the call that binds both the EU and the US. Discovering that — live — is part of the Lab.