Datenschutz in und durch Unternehmensgruppen im europäischen Datenschutzrecht

This work highlights the group-specific organisational requirements of European privacy law, as well as its requirements for group-internal data transmissions. The latter are examined in light of the “small” group privilege, the German employment data protection law and the specific requirements for international data transfers. For this purpose, this work outlines the notion of data protection control within the meaning of sec. 4 no. 19 GDPR and shows the establishment of the concept of privacy control, which precludes the unreflected recourse to German company law for the determination of the group of companies within the scope of the GDPR. In light of this, this work also aims to show the group-specific organisation possibilities and limits of contract data processing as well as of the joint controllership.