@paulca
I second the wow and cannot comment specifically on much of what you describe for lack of knowledge.
I'm curious if the "wow" is because of the rat's nest of being internationally "seconded"/contracted or because I went there?
It is a rat's nest. Especially given the sector I work in is a high security information domain. I am legally bound internationally on many things, including criminal negligence type offenses. Thankfully I'm nowhere near the front line on those things. It's meaningless integers, reals, timestamps and strings to me. I'm thankful for that. I will talk about my work from a software/systems engineering aspect, but never using empirical business information or specifics. "Never take it home.", in the first place, policy. I'll talk about a company, but never mention which. I'll redact and fabricate specifics to give examples. I've yet to get in trouble for disclosure or other security related infractions, although I have whistle blown on a few practices and thankfully that was received as the correct professional checks and balances that needed to be addressed. (Account/password sharing. Cross/out of channel communications requesting internal company information or contact information).
I hadn't even thought of the "criminal" aspects. I mean whose law applies? If I am sitting in Belfast (UK with a big toe stuck in the EU's door), accessing a computer system in London, using it to access systems in the US, working with people from Singapore for a US company. I'd start by assuming "all of the above", and that's never really been a problem.
It's not really a problem now (limiting scope), but it's like I can hear the shells landing in the distance and a shift between the US and UK legal policies on factors such as discrimination and PII disclosure and protection, could move that front line closer and, not going to the
worst case scenario, I could be criminally or civilly charged in the states for a legally allowed action in the UK or vice versa. I don't know much about US law, but I do know a hell of a lot more about US law than I do Singapore law!
Personal issues with this asides, there are genuine professional information security issues presenting which ARE part of my professional scope of discussion in work. I am legally/professionally required to understand and adhere to things like GDPR et. al. and encourage enforcement of those policies in software.
I did look at what the "current" safe guards are on employee information transferred from the UK to the US and no surprises Brexit has more or less trashed it and paraphase: "there currently are short comings in the data transfer legislation which leaves UK employees unsatisfactorily protected". It basically says, "you be boned.", it's mostly up to the companies and their agreements, other more stringent frameworks exist, but they are not mandatory.
The GDPR (and other) 'rights' have a clause on consent. Consent is everything. You have to provide people with a real choice to provide or not provide the information. I don't get that, some times for regulatory reasons, but very often because it's a customer company asking for my details and they don't accept "N/A" and "Undisclosed" as answers in their part of the world. That has professional implications of refusal. Always saying "No" to requests for PII from customers would tend to make you inflexible and less valuable to your company.
In Northern Ireland we have been through this. It still goes on today. Every year, every employee must submit an FEC (Fair employment commission) disclosure stating their age, sex, religion and community alignment. These surveys, almost like voting, are meant to be handled in the upmost of privacy and the form does NOT include their name or any identifier which can be associated with an actual person. This is extremely heavily regulated "diversity" monitoring to highlight, not fix, but highlight "community biases"... the regulation around never attaching that information to PII is important. However it is of course frequently poorly executed. This year, a single person in HR emailed the entire Belfast office with a word document and asked to complete it. It wasn't even a well done Word form, it wasn't editable and you couldn't tick the tick boxes or edit the form text boxes. I did complete it and return it, but it felt wrong. In the days when it was a paper form, on site, it went back into a pile instantly, no identifier on it. But asking for it over email, or asking for it via anything BUT a completely anonymous route is a violation of the principle of it being none PII. Your name is on the email, your name is in the edit history on the document. Luckily it was to a single person email address, but you never can tell the actual distribution for monitoring.
The important, related part about this form is how it's processed. There is the "None of the above" type options. However the data officer is permitted to know the post code or primary school of the subject and is permitted to put an "assumed community" on the record. If THIS practice is applied to surveys on topics such as gender, sexual orientation, race, etc. etc. Many companies may have HR records inappropriately labelling me in a discriminatory way without consent to do so.
To keep your job, you maybe should just shut up and keep smiling, keep taking the salary.