Germany Privacy Update: Are Subsidiaries of Foreign Companies Prohibited from Processing Personal Data?

Deutsch: Ist Tochtergesellschaften ausländischer Unternehmen die Verarbeitung personenbezogener Daten in Deutschland verboten?

In the current issue of German professional journal ZD - Zeitschrift für Datenschutz (9/2022), Christian Schröder discusses whether and to what extent subsidiaries of foreign companies are prohibited from processing personal data in Germany.

In the decision of 13. July 2022 - 1 VK 23/22, which is not yet final and is currently pending before the Higher Regional Court of Karlsruhe, the Baden-Württemberg Procurement Chamber considerably extended the scope of chapter V of the GDPR for international transfers and called into question the legally compliant use of service providers with a connection to foreign countries even within the EU. The considerable legal uncertainty caused by this would not only affect European subsidiaries of U.S. tech companies, but numerous other businesses. They might now have to conduct far-reaching research into whether they could be obliged to hand over data to foreign authorities, either directly or indirectly via parent companies located abroad, under foreign law, such as the U.S. CLOUD Act in particular, and would not infrequently find themselves without practicable remedies if such a risk existed.