As I understand it, if a training company collects data during the training itself, is it an independent data controller?

ANSWER

It is not always possible to state this with certainty. Whether a training company will be an independent data controller requires a full assessment of the factual situation.

Where the employer merely selects training offered by an external company and does not in any way influence its programme or manner of delivery, the company conducting the training will be an independent data controller also in respect of data it collects independently.

Where the employer has influence over the training and decides on its content and course, the training company is merely a processor and will remain a processor even when it itself collects employees' data, e.g. when issuing certificates. One should not assess who collected the data, but whose purposes are being pursued through the collection of data.