“Employee records transferred to a parent company are governed by Directive (EU) 2016/679.”

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) … Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data.REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, … The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. (48) Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data. The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected. (49) The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. …

Having regard to Article 70 (1)(e) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, (hereinafter the “GDPR” or “Regulation”), … Example 9: A subsidiary (controller) in the EU shares data with its parent company (processor) in a third country The Irish Company X, which is a subsidiary of the parent Company Y in a third country, discloses personal data of its employees to Company Y to be stored in a centralised HR database by the parent company in the third country. In this case the Irish Company X processes (and discloses) the data in its capacity of employer and hence as a controller, while the parent company is a processor. Company X is subject to the GDPR pursuant to Article 3(1) for this processing and Company Y is situated in a third country. The disclosure therefore qualifies as a transfer to a third country within the meaning of Chapter V of the GDPR.The European Data Protection Board Having regard to Article 70 (1)(e) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, (hereinafter the “GDPR” or “Regulation”), Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018, 1 Having regard to Article 12 and Article 22 of its Rules of Procedure, … It should also be recalled that entities which form part of the same corporate group may qualify as separate controllers or processors. Consequently, data disclosures between entities belonging to the same corporate group (intra-group data disclosures) may constitute transfers of personal data. 20 Example 9: A subsidiary (controller) in the EU shares data with its parent company (processor) in a third country The Irish Company X, which is a subsidiary of the parent Company Y in a third country, discloses personal data of its employees to Company Y to be stored in a centralised HR database by the parent company in the third country. In this case the Irish Company X processes (and discloses) the data in its capacity of employer and hence as a controller, while the parent company is a processor. Company X is subject to the GDPR pursuant to Article 3(1) for this processing and Company Y is situated in a third country. The disclosure therefore qualifies as a transfer to a third country within the meaning of Chapter V of the GDPR. 2.3 The importer is in a third country, irrespective of whether or not this importer is subject to the GDPR for the given processing in accordance with Article 3, or is an international organisation

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance) … 11.For the purposes of paragraph 1(f), examples of types of processing that may be processing that is necessary for the purposes of a legitimate interest include— (a)processing that is necessary for the purposes of direct marketing, (b)intra-group transmission of personal data (whether relating to clients, employees or other individuals) where that is necessary for internal administrative purposes, and (c)processing that is necessary for the purposes of ensuring the security of network and information systems. … “intra-group transmission” means transmission between members of a group of undertakings or between members of a group of institutions affiliated to a central body;- Skip to main content - Skip to navigation … 10.Regulations under paragraph 6 are subject to the affirmative resolution procedure. 11.For the purposes of paragraph 1(f), examples of types of processing that may be processing that is necessary for the purposes of a legitimate interest include— (a)processing that is necessary for the purposes of direct marketing, (b)intra-group transmission of personal data (whether relating to clients, employees or other individuals) where that is necessary for internal administrative purposes, and (c)processing that is necessary for the purposes of ensuring the security of network and information systems. 12.In paragraph 11— “intra-group transmission” means transmission between members of a group of undertakings or between members of a group of institutions affiliated to a central body; “security of network and information systems” has the same meaning as in the Network and Information Systems Regulations 2018 (S.I. 2018/506) (see regulation 1(3)(g)).]

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) … ‘group of undertakings’ means a controlling undertaking and its controlled undertakings; … ‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity;--- ►B · REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) (OJ L 119 4.5.2016, p. 1) Corrected by: … (19) ‘group of undertakings’ means a controlling undertaking and its controlled undertakings; (20) ‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity; (21)

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) … Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data.--- REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) … The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. | (48) · Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data. The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected. (49) · The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. …

1 This request for a preliminary ruling concerns the interpretation of Article 88(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’). … 2. Those rules shall include suitable and specific measures to safeguard the data subject’s human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place. … 49 The same conclusion must be reached in relation to the fact that Article 88(2) of the GDPR mentions, among the three factors to which the Member States must have ‘particular regard’ when adopting those ‘more specific rules’, the transfer of personal data ‘within a group of undertakings, or a group of enterprises engaged in a joint economic activity’.… Gane and A. Wellman, acting as Agents, – the European Commission, by F. Erlbacher, H. Kranenborg and D. Nardi, acting as Agents, after hearing the Opinion of the Advocate General at the sitting on 22 September 2022, gives the following Judgment 1 This request for a preliminary ruling concerns the interpretation of Article 88(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’). 2 The request was made in the course of proceedings between the Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium (Principal Staff Committee for Teachers at the Ministry of Education and Culture of the Land Hessen, Germany) and the … 2. Those rules shall include suitable and specific measures to safeguard the data subject’s human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place. 3. Each Member State shall notify to the [European] Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.’ National law … 48 Consequently, it cannot be inferred from the reference to the ‘performance of the contract of employment’ in Article 88(1) of the GDPR that employment in the public sector that is not based on an employment contract is excluded from the scope of that provision. 49 The same conclusion must be reached in relation to the fact that Article 88(2) of the GDPR mentions, among the three factors to which the Member States must have ‘particular regard’ when adopting those ‘more specific rules’, the transfer of personal data ‘within a group of undertakings, or a group of enterprises engaged in a joint economic activity’. The other two factors, namely the transparency of processing and monitoring systems at the work place, are relevant both to employment in the private sector and to employment in the public sector, whatever the nature of the legal relationship that binds the employee to the employer.

Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), … 3. The draft BCR-C for employee data of the UPS Group covers intra-group transfers to third countries amongst the UPS Group affiliates and the processing of personal data by UPS group affiliates legally bound by this BCR 9.The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), Having regard to the European Economic Area (hereinafter “EEA”) Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 1, Having regard to the judgment of the Court of Justice of the European Union Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems, C-311/18 of 16 July 2020, Having regard to EDPB Recommendations 01/2020 on measures that supplement transfer tools to … #### 2 ASSESSMENT 3. The draft BCR-C for employee data of the UPS Group covers intra-group transfers to third countries amongst the UPS Group affiliates and the processing of personal data by UPS group affiliates legally bound by this BCR 9. 4. Concerned data subjects include current and former employees (including temporary workers, independent contractors and trainees), job applicants, current and former shareholders, current and 6 Recommendations 1/2022, paragraph 13. 7 Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents. …

Having regard to Articles 47, 57 and 64 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR);Subject: approval decision of the UPS Controller Binding Corporate Rules for employee data by the General Secretariat of the Belgian Data Protection Authority (DOS-2023-03967) Pursuant to the request by UPS Europe SRL on behalf of the UPS group, received on 10 February 2021, for approval of their binding corporate rules for controller for employee data; Having regard to Articles 47, 57 and 64 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR); Having regard to Article 20, §1, 8° of the Act of 3 December 2017 establishing the Data Protection Authority (« Loi du 3 décembre 2017 portant création de l'Autorité de protection des données » or «Wet van 3 december 2017 tot oprichting van de Gegevensbeschermingsautoriteit»);

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) … ‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity;- Skip to main content - Skip to navigation … (20) ‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity; (21)

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance) … 5. Article 88. Processing in the context of employmentRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance) Regulation (EU) 2016/679 of the European Parliament and of the Council Show full title … Additional requirements when processing for RAS purposes 3. Article 84C. Appropriate safeguards 4. Article 84D. Appropriate safeguards: further provision 11. CHAPTER IX Provisions relating to other specific processing situations 1. Article 85. Processing and freedom of expression and information 2. Article 86. Processing and public access to official documents 3. Article 86A. Processing and national security and defence 4. Article 87. Processing of the national identification number 5. Article 88. Processing in the context of employment 6. Article 89. Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes 7. Article 90. Obligations of secrecy 8. Article 91. Existing data protection rules of churches and religious associations 12. CHAPTER 9A Regulations 1. Article 91A. Regulations made by Secretary of State 13. CHAPTER X Delegated acts and implementing acts

The case involved an employee claiming damages after their employer allegedly violated GDPR by transferring personal data to the parent company to test a cloud-based HR software. … Prior to its decision, the BAG referred the case to the European Court of Justice (“CJEU”), which emphasized that any personal data processing in the employment context must adhere to GDPR standards (CJEU, Judgment of December 19, 2024, C-65/23).Intra-group data transfers must be supported by a valid legal basis. The BAG addressed the issue of intra-group data transfers, particularly involving U.S.-based third-party service providers. The case involved an employee claiming damages after their employer allegedly violated GDPR by transferring personal data to the parent company to test a cloud-based HR software. Although a works council agreement regulated certain data transfers, additional personal data like salary, private address and tax ID were transferred without legal basis. Prior to its decision, the BAG referred the case to the European Court of Justice (“CJEU”), which emphasized that any personal data processing in the employment context must adhere to GDPR standards (CJEU, Judgment of December 19, 2024, C-65/23). The BAG followed the CJEU's decision, finding that the data transfer could not be justified by the employer's legitimate interests under Article 6(1)(f) GDPR. The BAG also found that the loss of control over the employee's data constituted an immaterial damage under Art. 82 GDPR and granted the plaintiff damages in the amount of EUR 200 (as the German Federal Court similarly ruled in its lead decision previously). What companies should do

For this test run, the employer had transferred various employee data from the SAP software previously used to a server of the parent company in the US. The plaintiff considered this data transfer to be unlawful, as it was not necessary for the execution of the employment relationship or for testing the Workday software. … With regard to the first question, the ECJ stated that data processing regulated by works agreements must meet all the requirements of the GDPR. Otherwise, the high level of protection afforded by the GDPR in the employment context could be circumvented. … Employers must ensure that any processing of personal employee data on the basis of a works agreement complies with the requirements of the GDPR.… In the context of the group-wide introduction of the cloud-based personnel management system "Workday," the employer had concluded a "provisional works agreement" with its works council for the introduction of the system during a test period with limited use. For this test run, the employer had transferred various employee data from the SAP software previously used to a server of the parent company in the US. The plaintiff considered this data transfer to be unlawful, as it was not necessary for the execution of the employment relationship or for testing the Workday software. In addition, he claimed that the limits of the "provisional works agreement" had been exceeded because the employer had transferred data categories that were not covered by the works agreement (including contract and remuneration details, social security number, and tax identification number) to the parent company. … The ECJ's decision rejected the hope that customized solutions for company data processing would be permissible. With regard to the first question, the ECJ stated that data processing regulated by works agreements must meet all the requirements of the GDPR. Otherwise, the high level of protection afforded by the GDPR in the employment context could be circumvented. Accordingly, the principles relating to processing of personal date set out in Art. 5 GDPR, the requirements for lawful data processing set out in Art. 6 para. 1 GDPR and the special requirements for special categories of personal data (e.g. health data) set out in Art. 9 para. 1 GDPR must be observed. … ## Practical consequences for employers The ECJ's decision has far-reaching implications for employers and the negotiation of works agreements. Employers must ensure that any processing of personal employee data on the basis of a works agreement complies with the requirements of the GDPR. In view of the full judicial review, this means that employers must ensure that any new systems or procedures for processing personal data are truly necessary and comply with the principles of data minimization and lawfulness. Care must be taken here because violations can result in claims for damages and administrative fines.

Review Data Transfer Practices: Companies should ensure compliance with GDPR when transferring employee data internationally, especially under collective agreements. … The CJEU outlined that a company processed certain personal data of its employees using SAP software and transferred various personal data of its employees from the SAP software to a server of its parent company in the US.Things to Consider - Review Data Transfer Practices: Companies should ensure compliance with GDPR when transferring employee data internationally, especially under collective agreements. Frequently Asked Questions … What does the CJEU judgement emphasize regarding GDPR compliance? show answer On July 2, 2025, the Court of Justice of the European Union (CJEU) published the operative judgement in Case C-65/23 MK v K GmbH, following the publication of the CJEU's judgement on December 19, 2024 (judgement of December 19, 2024)BackgroundThe CJEU outlined that a company processed certain personal data of its employees using SAP software and transferred various personal data of its employees from the SAP software to a server of its parent company in the US.Moreover, on July 3, 2017, the company and its works council concluded an agreement confirming acquiescence as regards the introduction of Workday software, which prohibited, inter alia, the use of that software for human resources man

By way of example, an Australian entity providing a central HR function for its group, including EU entities, could be subject to the GDPR with respect to the EU data but this would not mean that it was subject to the GDPR with respect to its Australian employees' data.… On a practical level, this confirms that, just because an organisation located outside of the EU is caught with respect to the processing of certain data sets, does not mean that the entire organisation and all data sets are also subject to the GDPR. By way of example, an Australian entity providing a central HR function for its group, including EU entities, could be subject to the GDPR with respect to the EU data but this would not mean that it was subject to the GDPR with respect to its Australian employees' data. The EDPB has also confirmed that the mere presence of an EU employee or agent is not sufficient to trigger the application of the GDPR so long as the relevant processing is not being carried out in the context of the activities of the EU-based employee.

All intra-group data transfers, especially those involving cloud tools or real test data, are subject to stringent, reviewable limits. … A German employer within an international group sought to introduce the Workday cloud HR platform in 2017. The company’s works council (Betriebsrat), which is a representative body for a company’s employees representing the employees, approved a collective agreement (Betriebsvereinbarung) permitting temporary use of specified categories of employee data, like name, entry date, and work location during a pilot phase to “feed” the system. Despite these limits, the company transferred additional sensitive data for testing, including salary details, private address, birth date, marital status, social security, and tax ID. … Breach Confirmed: Transferring employee data categories beyond those in the works agreement – without an independent legal basis – violated GDPR.… It confirms: - Even minor breaches, like over-inclusion of personal data in a temporary software test, may result in compensation claims. - No collective agreement can dilute GDPR protections. - All intra-group data transfers, especially those involving cloud tools or real test data, are subject to stringent, reviewable limits. - Compensable damage does not require financial loss. Rather, a loss of control over personal data suffices. The Workday Case Details A German employer within an international group sought to introduce the Workday cloud HR platform in 2017. The company’s works council (Betriebsrat), which is a representative body for a company’s employees representing the employees, approved a collective agreement (Betriebsvereinbarung) permitting temporary use of specified categories of employee data, like name, entry date, and work location during a pilot phase to “feed” the system. Despite these limits, the company transferred additional sensitive data for testing, including salary details, private address, birth date, marital status, social security, and tax ID. In consequence, an employee claimed immaterial damages under Article 82 GDPR for the unlawful transfer, claiming loss of control over his personal data. … The BAG’s Final Ruling: Key Takeaways - Breach Confirmed: Transferring employee data categories beyond those in the works agreement – without an independent legal basis – violated GDPR. - Immaterial Damage and Loss of Control: The BAG recognized that the mere loss of control over personal data constitutes a compensable nonmaterial damage. A claimant does not need to prove economic loss or a certain threshold of seriousness. …

In that context, the defendant in the main proceedings transferred various personal data of its employees from the SAP software to a server of the D group’s parent company in the United States. … The applicant claimed, inter alia, that the defendant in the main proceedings had transferred, to the parent company’s server, personal data concerning him, some of which were not mentioned in the works agreement confirming acquiescence, in particular his private contact information, contractual and remuneration details, his national insurance and tax identification numbers, his nationality and his marital status. … The referring court takes the view that the operations challenged by the applicant in the main proceedings fall within the material scope of the GDPR, since they constitute ‘processing’ of ‘personal data’ of that ‘data subject’, within the meaning of Article 4(1) and (2) of that regulation.15 In 2017, the D group of companies, to which the defendant in the main proceedings belongs (‘the D group’), introduced, throughout that group, the cloud-based software called ‘Workday’ (‘the Workday software’) as a single personnel information management system. In that context, the defendant in the main proceedings transferred various personal data of its employees from the SAP software to a server of the D group’s parent company in the United States. … The applicant claimed, inter alia, that the defendant in the main proceedings had transferred, to the parent company’s server, personal data concerning him, some of which were not mentioned in the works agreement confirming acquiescence, in particular his private contact information, contractual and remuneration details, his national insurance and tax identification numbers, his nationality and his marital status. 18 As he did not obtain full satisfaction, the applicant in the main proceedings brought an appeal on a point of law before the Bundesarbeitsgericht (Federal Labour Court, Germany), which is the referring court. … 21 The referring court takes the view that the operations challenged by the applicant in the main proceedings fall within the material scope of the GDPR, since they constitute ‘processing’ of ‘personal data’ of that ‘data subject’, within the meaning of Article 4(1) and (2) of that regulation. In addition, it states that the defendant in the main proceedings is a ‘controller’, within the meaning of Article 4(7) of that regulation. …

This request for a preliminary ruling concerns the interpretation of Article 82(1) and of Article 88(1) and (2), read in conjunction with Article 5, Article 6(1) and Article 9(1) and (2), of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’). … In 2017, the D group of companies, to which the defendant in the main proceedings belongs (‘the D group’), introduced, throughout that group, the cloud-based software called ‘Workday’ (‘the Workday software’) as a single personnel information management system. In that context, the defendant in the main proceedings transferred various personal data of its employees from the SAP software to a server of the D group’s parent company in the United States.Judgment 1 · This request for a preliminary ruling concerns the interpretation of Article 82(1) and of Article 88(1) and (2), read in conjunction with Article 5, Article 6(1) and Article 9(1) and (2), of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’). 2 · The request has been made in proceedings between MK, a natural person, and K GmbH, his employer, concerning compensation for the non-material damage which that person claims to have suffered on account of the processing of his personal data by that company on the basis of a works agreement. --- · --- · … · 14 · Initially, that company processed certain personal data of its employees in the context of the use of software called ‘SAP’ (‘the SAP software’), including for accounting purposes, and it concluded, with its works council, several works agreements in that regard. 15 · In 2017, the D group of companies, to which the defendant in the main proceedings belongs (‘the D group’), introduced, throughout that group, the cloud-based software called ‘Workday’ (‘the Workday software’) as a single personnel information management system. In that context, the defendant in the main proceedings transferred various personal data of its employees from the SAP software to a server of the D group’s parent company in the United States. 16 · On 3 July 2017, the defendant in the main proceedings and its works council concluded an agreement confirming acquiescence as regards the introduction of the Workday software (‘the works agreement confirming acquiescence’), which prohibited, inter alia, the use of that software for human resources management purposes, such as the appraisal of a worker, during the test phase. …

Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients’ or employees’ personal data.Recital 48 Overriding Legitimate Interest Within Group of Undertakings* 1 Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients’ or employees’ personal data. 2 The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected. * This title is an unofficial description.

Those rules shall include suitable and specific measures to safeguard the data subject’s human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.… 2. Those rules shall include suitable and specific measures to safeguard the data subject’s human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place. 3. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them. Suitable Recitals

This request for a preliminary ruling concerns the interpretation of Article 82(1) and of Article 88(1) and (2), read in conjunction with Article 5, Article 6(1) and Article 9(1) and (2), of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’). … In 2017, the D group of companies, to which the defendant in the main proceedings belongs (‘the D group’), introduced, throughout that group, the cloud-based software called ‘Workday’ (‘the Workday software’) as a single personnel information management system. In that context, the defendant in the main proceedings transferred various personal data of its employees from the SAP software to a server of the D group’s parent company in the United States.¶1 This request for a preliminary ruling concerns the interpretation of Article 82(1) and of Article 88(1) and (2), read in conjunction with Article 5, Article 6(1) and Article 9(1) and (2), of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’). > Topics: Personal Data, Processing · Applies: gdpr-art-6-par-1-en, gdpr-art-9-par-1-en, gdpr-art-82-par-1-en, gdpr-art-88-par-1-en, gdpr-art-5-en … ### ¶15 In 2017, the D group of companies, to which the defendant in the main proceedings belongs (‘the D group’), introduced, throughout that group, the cloud-based software called ‘Workday’ (‘the Workday software’) as a single personnel information management system. In that context, the defendant in the main proceedings transferred various personal data of its employees from the SAP software to a server of the D group’s parent company in the United States. > Topics: Personal Data

Article 88 of the General Data Protection Regulation (Regulation (EU) 2016/679). … Those rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.- Rules must include measures to safeguard dignity, legitimate interests and fundamental rights. - A frequent basis for national employee-monitoring and HR-data rules. Article 88 of the General Data Protection Regulation (Regulation (EU) 2016/679). Read the full, authoritative text on EUR-Lex. Official text … Those rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

(48) Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data.Recital 48 EU GDPR (48) Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data. The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected.

(48) Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data.Recital 48 EU GDPR (48) Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data. The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected.

Finally, Recital 48 of the GDPR explains when controllers that are part of a group of undertakings may transfer personal data within a group of undertakings. They may have 'a legitimate interest to transfer personal data within the group of undertakings for internal administrative purposes, including the processing of personal data of customers and employees', while the 'basic principles for the transfer of personal data within groups of undertakings to an undertaking in a third country' remain unaffected. … The possibility of transferring employee data within a group is particularly important where, for example, a central HR department is to be responsible for the employees of all group companies.… An undertaking which controls the processing of personal data in its connected undertakings should be considered together with those undertakings as a 'group of undertakings'. Finally, Recital 48 of the GDPR explains when controllers that are part of a group of undertakings may transfer personal data within a group of undertakings. They may have 'a legitimate interest to transfer personal data within the group of undertakings for internal administrative purposes, including the processing of personal data of customers and employees', while the 'basic principles for the transfer of personal data within groups of undertakings to an undertaking in a third country' remain unaffected. Be on the safe side with a Group Privacy Officer … 6 para. 1 lit. b GDPR. Pursuant to Art. 6 para. 1 lit. b GDPR, data processing is permitted if it is necessary for the performance of a contract to which the data subject is a party. The term "performance of a contract" is to be understood broadly and includes the establishment, performance or termination of an employment relationship. Other transfers within a group, for example for commercial or administrative purposes, are not covered. The possibility of transferring employee data within a group is particularly important where, for example, a central HR department is to be responsible for the employees of all group companies. In principle, such an organisation is also legally possible. The application of Art. 6 para. 1 lit. b GDPR is the necessity of the data processing specifically for the employment relationship. A necessity test must be carried out, in which the "conflicting fundamental rights positions", the "interests of the employer in data processing and the personal rights of the employee" must be balanced as fairly as possible by weighing the interests involved.

The General Data Protection Regulation (Regulation (EU) 2016/679), [1] abbreviated GDPR, is a European Union regulation on information privacy in the European Union (EU) and the European Economic Area (EEA). … As an EU regulation (instead of a directive), the GDPR has direct legal effect and does not require transposition into national law. … There are exceptions for data processed in an employment context or in national security that still might be subject to individual country regulations. [1]: Arts. 2(2)(a) & 88… Journal reference · L119, 4 May 2016, p. 1–88 History Date made · 14 April 2016 Implementation date · 25 May 2018 Preparative texts Commission proposal · COM/2012/010 final – 2012/0010 (COD) Other legislation Replaces · Data Protection Directive Current legislation The General Data Protection Regulation (Regulation (EU) 2016/679), [1] abbreviated GDPR, is a European Union regulation on information privacy in the European Union (EU) and the European Economic Area (EEA). The GDPR is an important component of EU privacy law and human rights law, in particular Article 8(1) of the Charter of Fundamental Rights of the European Union. It also governs the transfer of personal data outside the EU and EEA. … [2] It supersedes the Data Protection Directive 95/46/EC and, among other things, simplifies the terminology. The European Parliament and Council of the European Union adopted the GDPR on 14 April 2016, to become effective on 25 May 2018. As an EU regulation (instead of a directive), the GDPR has direct legal effect and does not require transposition into national law. However, it also provides flexibility for individual member states to modify (derogate from) some of its provisions. As an example of the Brussels effect, the regulation became a model for many other laws around the world, including in Brazil, [3] Japan, Singapore, South Africa, South Korea, Sri Lanka, and Thailand. … The lead authority thus acts as a " one-stop shop" to supervise all the processing activities of that business throughout the EU. [12] [13] A European Data Protection Board (EDPB) co-ordinates the SAs. EDPB thus replaces the Article 29 Data Protection Working Party. There are exceptions for data processed in an employment context or in national security that still might be subject to individual country regulations. [1]: Arts. 2(2)(a) & 88 Principles and lawful purposes

Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients’ or employees’ personal data. … Recital 48 explains that controllers within a group of undertakings may have a legitimate interest in transferring personal data within the group for internal administrative purposes, such as managing clients or employees. However, such transfers must still comply with GDPR principles and ensure appropriate safeguards, especially when data is transferred to entities located outside the European Union.By Vivek D / November 15, 2024 1 Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients’ or employees’ personal data. 2 The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected. * This title is an unofficial description. Why Recital 48 Matters for GDPR Compliance? Recital 48 explains that controllers within a group of undertakings may have a legitimate interest in transferring personal data within the group for internal administrative purposes, such as managing clients or employees. However, such transfers must still comply with GDPR principles and ensure appropriate safeguards, especially when data is transferred to entities located outside the European Union.

General Data Protection Regulation · UE 2016/679 Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data.Recital 48 General Data Protection Regulation · UE 2016/679 Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data. The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected. The classic trap

The problem is aggravated by the EU General Data Protection Regulation, which will be applicable as of May 25 2018. According to the regulation, even fines of up to €20 million or 4% of the annual turnover – possibly of the entire group – could be imposed. … Data privacy protection laws are largely harmonised within the European Union by way of the EU Data Protection Directive (1995/46/EC).This is no longer a purely theoretical problem. Supervisory authorities have intensified their activities and increasingly imposed fines on companies and employees, as well as responsible managing directors and board members. The problem is aggravated by the EU General Data Protection Regulation, which will be applicable as of May 25 2018. According to the regulation, even fines of up to €20 million or 4% of the annual turnover – possibly of the entire group – could be imposed. Data protection law does not facilitate the exchange of data within group structures; there is thus no group privilege. Transfers between legally independent companies belonging to the same group are treated the same as transfers to third parties by the law. Under data protection law, each company is deemed an independently responsible party (Section 3(7) of the Federal Data Protection Act). … If the affiliated group company is domiciled abroad, there are stricter requirements to be fulfilled. In such a case, the data transfer does not only have to be per se permitted. In addition, there must be an adequate level of data protection in the receiving country. European Union and European Economic Area A transfer of data within the European Union and the European Economic Area is not a problem. Data privacy protection laws are largely harmonised within the European Union by way of the EU Data Protection Directive (1995/46/EC). The European Economic Area contracting countries – Norway, Iceland and Liechtenstein – have adopted the directive and also warrant a level of data protection that corresponds to that required under the Federal Data Protection Act. Data transfers to these countries do not, therefore, require any additional justification (Section 4b(2) of the act).

It is sometimes taken for granted that employee data is transferred from one group company to another for the purpose of payroll processing, personnel administration or for tax reasons, stored there and used for the respective purpose. It is obvious that personal data relevant under data protection law, i.e. employee data, is processed in the process. However, it is often unclear on what legal basis the intra-group data transfer is based and whether it is actually permissible under data protection law in the specific case. … In addition to the defendant's obligation to delete all data affected by the transfer, regardless of the type of storage medium (cloud, database, Excel, tablets, cell phones, business PCs, etc.), the court also awarded the plaintiff (non-material) damages in the amount of €8,000 (Article 82 (1) GDPR). … However, in its decision, the Bochum Regional Court impressively demonstrated that the transfer of data within a group is by no means an unobjectionable business transaction at any time, but rather imposes legal requirements on all group companies involved in the transfer.Data protection practical tip on LG Bochum, judgment of 22.01.2020, Ref. 2 O 186/19, I-2 O 186/19 Internal data transfer between different companies of a group is nothing new in times of extensive technical and personal networking. It is sometimes taken for granted that employee data is transferred from one group company to another for the purpose of payroll processing, personnel administration or for tax reasons, stored there and used for the respective purpose. It is obvious that personal data relevant under data protection law, i.e. employee data, is processed in the process. However, it is often unclear on what legal basis the intra-group data transfer is based and whether it is actually permissible under data protection law in the specific case. The Bochum Regional Court addressed this question (in excerpts) in a decision from 2020 and determined - this much should be anticipated - that a data transfer of personal (employee) data was not covered by the employer's "legitimate interest" in the case at issue. The verdict … The purpose of this data transfer was to create a database with comparative values on salaries for new employment contracts to be concluded. In addition to the defendant's obligation to delete all data affected by the transfer, regardless of the type of storage medium (cloud, database, Excel, tablets, cell phones, business PCs, etc.), the court also awarded the plaintiff (non-material) damages in the amount of €8,000 (Article 82 (1) GDPR). The court based its decision on the argument that the defendant could not invoke a suitable legal basis for the data transfer carried out. … ###### Outlook There is no question that employers within a group structure have to process employee data and do so to a certain extent. However, in its decision, the Bochum Regional Court impressively demonstrated that the transfer of data within a group is by no means an unobjectionable business transaction at any time, but rather imposes legal requirements on all group companies involved in the transfer. If a company affiliated with the employer ignores these requirements, it not only faces an obligation to delete the data, but also incurs liability for damages.

Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data.Recital (48) Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data. The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected.

In that context, the defendant in the main proceedings transferred various personal data of its employees from the SAP software to a server of the D group’s parent company in the United States. … Only that applicant’s claim for compensation, on the basis of the GDPR, for the non-material damage that he allegedly suffered as a result of the unlawful processing of his personal data by means of the Workday software, during the period from the first day on which that regulation became applicable, namely 25 May 2018, until the end of the first quarter of 2019, is still pending. … The referring court takes the view that the operations challenged by the applicant in the main proceedings fall within the material scope of the GDPR, since they constitute ‘processing’ of ‘personal data’ of that ‘data subject’, within the meaning of Article 4(1) and (2) of that regulation.… agreements in that regard. 15 In 2017, the D group of companies, to which the defendant in the main proceedings belongs (‘the D group’), introduced, throughout that group, the cloud-based software called ‘Workday’ (‘the Workday software’) as a single personnel information management system. In that context, the defendant in the main proceedings transferred various personal data of its employees from the SAP software to a server of the D group’s parent company in the United States. 16 On 3 July 2017, the defendant in the main proceedings and its works council concluded an agreement confirming acquiescence as regards the introduction of the Workday software (‘the works agreement confirming acquiescence’), which prohibited, inter alia, the use of that software for human resources … insurance and tax identification numbers, his nationality and his marital status. 18 As he did not obtain full satisfaction, the applicant in the main proceedings brought an appeal on a point of law before the Bundesarbeitsgericht (Federal Labour Court, Germany), which is the referring court. Only that applicant’s claim for compensation, on the basis of the GDPR, for the non-material damage that he allegedly suffered as a result of the unlawful processing of his personal data by means of the Workday software, during the period from the first day on which that regulation became applicable, namely 25 May 2018, until the end of the first quarter of 2019, is still pending. 19 As regards the unlawfulness of that processing, the applicant in the main proceedings claims, first, that that processing was not necessary for the purposes of the employment relationship, for which the defendant in the main proceedings at the time used the SAP software, or for the purpose of testing the … complies with the requirements of the GDPR, that the burden of proof lies with the applicant in the main proceedings and that he has not demonstrated either the existence of non-material damage or a causal link between a possible infringement of that regulation and the alleged damage. 21 The referring court takes the view that the operations challenged by the applicant in the main proceedings fall within the material scope of the GDPR, since they constitute ‘processing’ of ‘personal data’ of that ‘data subject’, within the meaning of Article 4(1) and (2) of that regulation. In addition, it states that the defendant in the main proceedings is a ‘controller’, within the meaning of Article 4(7) of that regulation. As regards the temporal scope of that regulation, it observes that while processing did start before the date on …

Here you can find the official PDF of the Regulation (EU) 2016/679 (General Data Protection Regulation) in the current version of the OJ L 119, 04.05.2016; cor. OJ L 127, 23.5.2018 as a neatly arranged website. … Article 47 Binding corporate rules … Article 88 Processing in the context of employmentGeneral Data Protection Regulation GDPR Welcome to gdpr-info.eu. Here you can find the official PDF of the Regulation (EU) 2016/679 (General Data Protection Regulation) in the current version of the OJ L 119, 04.05.2016; cor. OJ L 127, 23.5.2018 as a neatly arranged website. All Articles of the GDPR are linked with suitable recitals. The European Data Protection Regulation is applicable as of May 25th, 2018 in all member states to harmonize data privacy laws across Europe. If you find the page useful, feel free to support us by sharing the project. Quick Access … Article 46 Transfers subject to appropriate safeguards Article 47 Binding corporate rules Article 48 Transfers or disclosures not authorised by Union law … Article 87 Processing of the national identification number Article 88 Processing in the context of employment Article 89 Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

Two companies in the same group use the same HR system. The parent evaluates key figures, the subsidiary keeps the personnel files, and a third company of the group operates the system. There are no contracts between the three, because after all it is the same group. … Companies within a group of undertakings are not subject to any special data protection rules merely because they belong to the same group. What matters under Art. 4(7) GDPR is, in each case, the entity that determines the purposes and means of processing. Because the group itself is not such an entity, transferring personal data between group companies also requires its own legal basis.One system, three companies, no roles Two companies in the same group use the same HR system. The parent evaluates key figures, the subsidiary keeps the personnel files, and a third company of the group operates the system. There are no contracts between the three, because after all it is the same group. There is no group privilege Companies within a group of undertakings are not subject to any special data protection rules merely because they belong to the same group. What matters under Art. 4(7) GDPR is, in each case, the entity that determines the purposes and means of processing. Because the group itself is not such an entity, transferring personal data between group companies also requires its own legal basis. Recital 48 acknowledges that controllers within a group of undertakings may have a legitimate interest in transmitting personal data for internal administrative purposes. That is a possible legal basis under Art. 6(1)(f) GDPR and not a merger of roles.

Scenario 1 — Company A as processor for Company B. If one company processes data on behalf of and under the instructions of another, it acts as a data processor. This requires a data processing agreement under Article 28 GDPR. A typical example: a group headquarters providing centralised HR and payroll services to subsidiaries.Three scenarios are possible: Scenario 1 — Company A as processor for Company B. If one company processes data on behalf of and under the instructions of another, it acts as a data processor. This requires a data processing agreement under Article 28 GDPR. A typical example: a group headquarters providing centralised HR and payroll services to subsidiaries. Scenario 2 — Joint controllership. If two or more companies jointly determine the purposes and means of processing the same personal data, they become joint controllers within the meaning of Article 26 GDPR. This requires a joint controllership arrangement and informing data subjects about it. A typical example: a shared customer database or a shared CRM platform used across the group.