Whose 'Purpose' is being pursued here?
Here's the situation:
We are Company A. We make investments into other companies. When we make an investment into a company, one of our senior employees takes a board member position within that company. Let's call them Company B.
Company B act independently of us (A) but we do have an interest in how our investment is doing, and by having an employee as a board member, we get regular updates through them.
Here's the interesting part- our employee retains and uses their Company A email account when performing their role as a board member of Company B. That means we have lots of data (and personal data) relating to Company B. This is where the question of purpose arises. It might be on our email system (and that's another debate entirely) but whose purpose is it for?
We've had a DSAR submitted to us from a former employee of Company B. I think it's fair to say that the former employee knows that we (A) hold their personal data because they are aware that one of the board members uses their Company A (our) email when performing their role as board member for B. They also likely know that we (A) therefore hold a lot of their personal data in our email system. The information requested relates to their time and role as an employee of Company B. I won't go into details, but the request is specific in nature (it's not a 'give me everything' DSAR).
Merely holding the data doesn't necessarily mean we are dictating the purpose as controller, and if that's the case, the data won't be in scope of the request. We do hold some personal data about the person where it is processed for our purpose (i.e. internal discussions about that person) but these are general discussions and don't meet the requirements of their request.
So the question is, whose purpose is being pursued? Are we in any way responsible for the data we hold in relation to our employee being a board member of B?
Thanks!