And, for the case of subsidaries, etc, "one company" is equal to "the entity that has access to the users data".

Want to share userdata with some subsidary? Then you also share responsibility with them.

It's necessary, for too many of these global corporations, a small local fine is too insignificant to bother heeding.