The transfer of personal data within a group of companies is not privileged under data protection law, i. e. it is treated as a transfer between independent companies. A disclosure of personal data to a third party occurs if the third party (this may also be a group company) does not process the data exclusively for the purposes and on behalf of the controller, but also uses it for its own purposes. Such disclosure shall only be permissible if it is covered by the purpose stated at the time when the personal data were collected or recognizable to the data subject. Stricter requirements apply to the disclosure of particularly sensitive personal data, which are only permissible if there is a justification.
