Yesterday were, as reported, the proposals of the State Policy Commission of the Council of States (SPK-SR) has been published. One of the more interesting innovations concerns the Group privilege: Within the framework of the justification regime, the SPK-SR proposes to slightly extend the justification of economic competition, but at the same time to omit it where personal data are disclosed to third parties. This exception is in turn supported by a Group privilege breachedThe disclosure of personal data within the same group of companies does not invalidate the justification of an overriding private interest based on economic competition.
At the same time beats the SPK-SR as a new Art. 27 para. 3 E-FDPA before, the Prohibit disclosure of personal data to third partiesunless the person concerned has expressly consented (“approved”). A group privilege is not provided for here.
However, if Art. 27(3) is taken at face value, i.e. if this provision is interpreted literally, then it contradicts the small group privilege in Art. 27 para. 2 lit. bIn this case, disclosure even within the group would only be possible with consent. The constellation envisaged by Art. 27(2)(b) within the group would be excluded in the context of the overriding interest. A literal interpretation of Art. 27 Par. 3 must therefore be rejected for systematic reasons. However, it would also be downright absurd in terms of content. Every company except the small SME would have to rely on explicit consent (which can be revoked at any time!) for all internal company processes. This can SPK-SR are not serious. Should this text nevertheless become law, Art. 27(3) would therefore have to be interpreted for systematic and teleological reasons in such a way that a group privilege also exists here, i.e. that the Prohibition of third-party disclosure within a group of companies does not apply. The Council of States will have the opportunity to provide clarity here.