Group Data Protection Officer

A significant challenge for data processing within different corporate groups is that there is no so-called “group privilege” in data protection law. This means that if personal data is transferred to a third party, i.e., outside the company itself, it does not matter whether this third party is a third party or a company within the group structure.

The GDPR provides some relief in group data protection for data transfers based on a legitimate interest of the companies involved. According to Recital 48 of the GDPR, data controllers that are part of a group of companies may have a legitimate interest in transferring personal data within this group for internal administrative purposes. Due to the lack of group privilege in the area of data protection, it is important to ensure that a legal basis exists for any intra-group exchange of personal data. Our experienced data protection consultants will be happy to help you implement data transfers within the corporate group that comply with data protection requirements.

The lack of group privilege poses challenges for group companies. Outsourcing certain corporate areas (e.g., accounting, human resources management or payroll) and centralizing data processing at the group parent will not be possible without further ado.

When introducing and using a group database, it must be clarified, for example, which company is actually “responsible” or whether “joint responsibility” between the participating group companies can even be considered. Under certain circumstances, commissioned processing may also be considered. In addition, companies are under an obligation to base each intra-group transfer of personal data on a valid legal basis. If a group company involved is located in a third country, additional requirements have to be fulfilled. If the group company independently processes employee data that it receives from a group company from the EEA area, the standard contractual clauses provided by the European Commission require supplementary regulations for data protection-compliant data transfer of employee data.

According to Art. 37 (2) GDPR, a group of companies may appoint a joint data protection officer, provided that the data protection officer can be reached from each branch. This was already permissible and customary under the German Federal Data Protection Act (BDSG). The GDPR makes this even easier. A significant advantage of appointing a group data protection officer is the establishment of a uniform level of data protection in the entrepreneurial group through the central organization.

Various models are available to achieve this purpose. Under the so-called single model, one and the same person can hold the function of data protection officer for several or all group companies. In this case, each group subsidiary has properly appointed this person as Group Data Protection Officer. The larger the corporate group, the more resources and employees the Group Data Protection Officer requires in the single model.

An alternative to this is the so-called coordinator model. In this model, each company in the group appoints its own data protection officer, while the group-wide data privacy organization is coordinated by a Group Data Protection Officer. What both models have in common is that all the threads come together at one expert office in order to find uniform solutions for cross-company issues in data privacy.