GDPR: CNIL 2026 vs EDPB on intra‑group — marketing?

Intra‑group: CNIL (2026) vs EDPB — marketing or admin?

On 10 June 2026, the CNIL clarified the rules on “transferring files to partners” for B2C prospecting: consent is required for electronic marketing, while legitimate interest may suffice for postal mailings. The EDPB, for its part, allows legitimate interest for intra‑group exchanges… but only for internal administrative purposes.

The case

The trigger was CNIL’s practical page of 10 June 2026 dedicated to sharing data with partners for B2C prospecting. It draws two regimes:

• if partners conduct prospecting by electronic means (email, SMS, automated call), the controller sharing the file must obtain prior specific consent from individuals for both the sharing and the partners’ prospecting, including information about the scope of partners; otherwise, sharing is unlawful and the partner cannot canvas. For postal marketing, sharing may rely on legitimate interest, subject to information and an effective right to object. Source: CNIL, “La prospection vers les particuliers (B to C): quelles règles pour transmettre des données à des partenaires ?” (10 June 2026). See cnil.fr. (cnil.fr)
• this position extends earlier CNIL practical schemes on “sharing data with partners” that require active, specific consent for electronic channels, with adequate information about partner identities. See the CNIL memo “Transmission des données à des partenaires” (PDF). (cnil.fr)

In parallel, in October 2024 the EDPB adopted its Guidelines on legitimate interest, expressly recalling that, under GDPR Recital 48, controllers within a group of undertakings may have a legitimate interest in sharing data “for internal administrative purposes” (including clients and employees). The EDPB nevertheless stresses the balancing test (Art. 6(1)(f)) and the right to object (Art. 21), particularly for direct marketing. See EDPB, “Guidelines 2024/01 on legitimate interest”. (edpb.europa.eu)

For Luxembourg, the CNPD recalls that entities within the same group are, in principle, distinct controllers; their exchanges may constitute disclosures and — if crossing the EEA border — fall under Chapter V (Arts. 44‑49). See CNPD, “Notion de transfert de données vers un pays tiers”; and “Transferts internationaux de données personnelles”. (cnpd.public.lu)

Legal reasoning

• Legal basis. GDPR Art. 6(1)(f) allows processing based on legitimate interest, subject to a documented balancing test between the controller’s interest and individuals’ rights and freedoms. The EDPB clarifies that Recital 48 covers intra‑group exchanges for “internal administrative purposes” (e.g., shared HR tools, consolidated accounting), but is not a blank check for other purposes, notably sister‑entity marketing. See EDPB 2024/01 with the explicit Recital 48 reference. (edpb.europa.eu)
• Direct marketing. GDPR Art. 21(2) establishes an unconditional right to object to direct marketing. In practice, for B2C electronic messages, ePrivacy rules and supervisory practice require prior opt‑in consent, including when marketing is carried out by partners or other group companies. CNIL states this clearly in its 10 June 2026 note and related guidance. (cnil.fr)
• Intra‑group sharing and international transfers. The CNPD highlights that group companies are often separate controllers; intra‑group sharing is a “disclosure to a recipient” that must be covered in information notices (Arts. 13/14 GDPR). If the recipient is outside the EEA (or access is made from a third country), this is a transfer subject to Chapter V (adequacy, BCR, SCC, etc.). See CNPD, “Notion de transfert…” and “Chapter V GDPR”, with BCR reminders (Art. 47). (cnpd.public.lu)
• Divergence in a nutshell. The EDPB accepts legitimate interest for strictly administrative intra‑group exchanges (Recital 48), whereas the CNIL requires prior, specific and traceable consent to share files for B2C prospecting by partners (including group entities) via email/SMS/robocalls. The CNPD, without contradicting the EDPB, warns that intra‑group does not erase legal basis and information duties, nor — if a third country is involved — Chapter V obligations. (edpb.europa.eu)

What this changes in practice

• Case 1 — “Internal administrative” (Luxembourg + EU). Pooling HR or customer data in a group ERP for consolidated accounting or internal administration may rely on legitimate interest (Art. 6(1)(f)), provided the balancing test shows necessity and proportionality, and information (Arts. 13/14) and security (Art. 32) are in place. EDPB + Recital 48 via CNPD. (edpb.europa.eu)
• Case 2 — “B2C marketing by a sister/subsidiary”. To share a customer/prospect list so another group company sends marketing emails or SMS, the CNIL requires prior specific consent covering both sharing and the partners’ marketing (partners identified by name or accessible list), and discourages any “consent passing” from partner to partner. Without such consent, electronic‑channel sharing is unlawful; mere legitimate interest does not suffice. (cnil.fr)
• Case 3 — “Transfer outside the EEA”. If the recipient subsidiary is in the United States or if the Luxembourg CRM is accessed from a third country, ensure a Chapter V mechanism (adequacy decision, approved BCR, SCC + TIA and supplementary measures). The CNPD reminds that intra‑group remains a transfer if it crosses the EEA. (cnpd.public.lu)
• Case 4 — “Postal prospecting”. The CNIL accepts legitimate interest for sharing files for postal mailings, subject to clear information and a simple, free opt‑out, including when the recipient is a partner. Beware of national rules (e.g., France’s B2C cold‑calling ban since 11 Aug 2026, unless consent). (cnil.fr)

Common pitfalls

1. “Recital 48 = all‑purpose pass”. No: the EDPB limits legitimate interest to “internal administrative purposes”. Marketing by another group entity does not, by nature, fall into this category. Document a Legitimate Interest Assessment (LIA) and, for partner e‑marketing, pivot to consent per CNIL guidance. (edpb.europa.eu)
2. Forgetting Art. 14 information when a partner/subsidiary reuses data. The partner contacting for the first time must inform about the source, legal basis and rights (including objection). (cnil-d10.cnil.fr)
3. Confusing “intra‑group in the EU” and “outside the EU”. Access from a third country to a CRM hosted in Luxembourg is a transfer: without a Chapter V mechanism, it is non‑compliant. (cnpd.public.lu)
4. “Passing consent” down the chain. Consent obtained for A and B does not automatically cover C and D; the CNIL rejects partner‑to‑partner consent passing. (cnil.fr)
5. Mixing HR/admin and marketing under a single purpose. Separate legal bases, notices, retention and access controls; keep an Art. 30 register per processing and intra‑group recipient.

Official sources

• CNIL — La prospection vers les particuliers (B to C): quelles règles pour transmettre des données à des partenaires? (10/06/2026): cnil.fr. (cnil.fr)
• CNIL — Transmission des données à des partenaires (PDF memo): cnil.fr. (cnil.fr)
• EDPB — Guidelines 2024/01 on legitimate interest (Recital 48 and Art. 21 right to object): edpb.europa.eu. (edpb.europa.eu)
• CNPD — Notion de transfert de données vers un pays tiers (intra‑group may be a transfer; Art. 3/Chapter V interaction): cnpd.public.lu. (cnpd.public.lu)
• CNPD — Transferts internationaux de données personnelles (principles and lawfulness bases): cnpd.public.lu.
• CNPD — GDPR Recitals (Recital 48 — intra‑group legitimate interest; marketing and objection): cnpd.public.lu.

Practical takeaway for Luxembourg executives in 2026: secure “administrative” intra‑group exchanges under legitimate interest with a robust LIA and clear information; for any sharing aimed at B2C marketing by sister entities, rely on granular consent per CNIL — and trigger Chapter V (SCC/BCR + TIA) as soon as a third country is involved. To operationalise this, consider an external DPO mandate and our resources on the GDPR framework.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.