Authors: Stefan Drewes and Sebastian Bretthauer
For the purposes of this Regulation:
(19) „group of undertakings“ means a controlling undertaking and its controlled undertakings;
The definition was undisputed during the legislative process.[1] A “group of undertakings“ consists of at least two undertakings: a controlling undertaking and a dependent undertaking. Although links between companies under corporate law are not taken into account in data protection law, the GDPR makes specific exceptions to accommodate interests of companies or groups of undertakings. Thus, with the introduction of the “group of undertakings” in the GDPR, economic circumstances are recognized to a limited extent.[2]
The definition of a group of undertakings presupposes that one undertaking can exert dominant influence over another undertaking.[3] According to recital 37, this dominant influence can arise from ownership, financial participation or the rules which govern it. Thus, it is not only a pure financial interest or a structure under corporate law that is important. De facto influence can also lead to the assumption of a group of undertakings.[4]
The assumption of a group of undertakings has the following implications: According to Art. 37 para. 2 (→ Art. 37 mn. 23 et seq.; cf. recital 48) these may appoint a single data protection officer. Furthermore, under Art. 47 para. 1a groups of undertakings can obtain approval for binding corporate rules as defined in Art. 4 para. 20 to be able to transfer personal data to third countries without an adequate level of data protection (→ Art. 4(20) mn. 1 et seq.; → Art. 47 mn. 1 et seq.; cf. recital 110). For a transfer of data based on the balancing of interests clause under Art. 6(1)(1)(f), the necessary legitimate interest is presumed under recital 48 in case of transfers within a group of undertakings. This recognition of economic circumstances facilitates the flow of data within the corporation.
Both Art. 47(1)(a), (2)(a), (f), (h), (j), (l) and (m) concerning binding internal data protection provisions (→ Art. 47 mn. 13 et seq.) and Art. 88(2) regarding data processing in the context of employment (→ Art. 88 mn. 34 et seq.) distinguish between a group of undertakings on the one hand and a group of enterprises engaged in a joint economic activity on the other.[5] The group of enterprises is an alliance of companies for a common economic purpose, without there actually being a controlling influence or special requirements for the structure of the group.[6]
[…]
[1]See also Drewes, ‘Art. 4(19)’, in Simitis/Hornung/Spiecker gen. Döhmann, para. 1 et seq.; Tosoni, ‘Art. 4(19)’ in Kuner/Bygrave/Docksey, 254 et seq.
[2]Tosoni, ‘Art. 4(19)’ in Kuner/Bygrave/Docksey, 255.
[3]Cornelius, NZWiSt 2016, 421 (423); Gola, K&R 2017, 145 (145 et seq.).
[4]See Schröder in Kühling/Buchner, Art. 4 (18), para. 1; but see also Ernst in Paal/Pauly, Art. 4 para. 129, according to which a group of undertakings can only be assumed if a “real company” exists and therefore understood too narrow.
[5] Latter is also addressed in Art. 4 para. 20, in Art. 36 para. 3a and in recitals 48 and 110.
[6] See Klabunde in Ehmann/Selmayr, Art. 4, para. 58; Ernst in Paal/Pauly, Art. 4, para. 130.