Editor’s note: The author of the piece, Alastair Wood, is a consultant at the Somers Partnership, the wealth management executive search business (to view its site, click here). This article was originally published in an “autumn update” by that firm and is republished here with its permission. 

Do you work for a private banking or wealth management organisation with a head office outside the European Union? If so you should be aware that you should have in place proper controls before you send information about your UK or EU based employees to head office. This also applies to information on candidates whom you may be considering employing. The penalties for not doing so are contained in a number of European and UK employment laws.

Dry as it appears, the EU Directive 95/46/EC of October 24 1995 is an important document that requires the placement of controls and disciplines on the transfer of personal data to any entity outside the European Union. Within the EU, data protection and employment laws are considered adequate to protect a person’s privacy and rights. It is the data exporter, in other words you, as the local representative of a branch or subsidiary of your parent company, who is responsible for putting safeguards in place and making sure they are adhered to.

The first step towards compliance with this aspect of European law is to download a Data Transfer Agreement from the Web. In completing the agreement, you should list as many data types as you are ever likely to “export”.  Once an agreement is in place you do not want to have to revisit it to add types of data you hadn’t thought of that is requested by the data importer, in other words your head office. List all the data types that apply to your business and discuss them with your colleagues to make sure you haven’t missed any.

As an employer the sort of data you are likely to export will probably fall into one of the following categories, although this is by no means an exhaustive list:

- Candidate information, including recommendations on suitability (or lack of suitability);

- Salary and bonus data with recommendations for individuals or groups;

- Appraisal details;

- Training;

- Findings from background checks and due diligence;

- Performance management, including disciplinary and grievance issues;

- Recommendations for promotion;

- Data on passports, education, home addresses and family information.

A transfer agreement requires both parties to the agreement to protect personal data and to make sure that it doesn’t fall into the hands of third parties. A provision in the agreement allows the data exporter to temporarily suspend the transfer of data if it suspects, or has evidence, that the data importer is breaching the terms of the agreement.

If your parent company is located in a country where there is less emphasis on data protection, or there are cultural differences which may lead to a different approach being taken to confidentiality then you should go to some lengths to explain why you are making a request for an official of the parent company to sign an agreement and to take responsibility for it.

It often helps if you explain that the parent company as well as the subsidiary or branch may have their image tarnished if a breach of confidentiality occurs. Europeans are not unduly litigious as is so often the case in the US; employees and job candidates, however, are increasingly aware of their rights. In a difficult economic climate and an even more difficult job market people will take steps to defend their rights, safe in the knowledge that it is unlikely there will be reprisals.

A breach would therefore be difficult or embarrassing for you if the importer is your ultimate employer. It is important that you, as the exporter, take every precaution to ensure that the agreement is understood and followed to the letter. It is recommended that a senior official of your parent company signs the agreement, not an expatriate who may be gone tomorrow.

What can go wrong if no agreement is in place?

It is possible that a disgruntled private banker, wealth manager, analyst or job candidate, considering that their pay review, incentive scheme, bonus award or failure to be hired (choose as appropriate) is not satisfactory, complains that a decision has been made by someone thousands of miles away, has caused them to be treated unfairly. They will argue that the person or persons making the decision have little understanding of local circumstances, are unaware of European employment laws and have acted in ignorance.

A complainant may then pursue a grievance under the terms of the agreement which allows a dispute to be settled by a competent court in the data exporter’s country. The complainant may also decide to pursue their grievance under other EU/UK employment legislation designed to protect them from unequal treatment or discrimination. In either instance the problem is yours.