What about the situation where there is a subsidiary and at the same time shared IT infrastructure for both companies (i.e. the parent company in effect provides IT services to the subsidiary)? Joint controllership or data entrustment in this situation?

ANSWER

Two situations should be distinguished here.

If the infrastructure is shared in such a way that both companies have mutual access to each other's data, make mutual use of each other's data and this is justified, one may speak of joint controllership; however, the specific factual situation requires analysis and above all establishing whether there will not be excessive mutual access to data of both companies.

Where the subsidiary in fact uses the parent company's IT infrastructure and the parent company therefore has access to its data and provides services to the subsidiary, concluding a data processing agreement is justified, with the subsidiary as controller and the parent company as processor.