That's what some people seem to think about Pocket belonging to Mozilla or Mozilla owning part of Cliqz... it's OK if they have a business relationship that loosely looks like control
Without knowing anything about the specifics here... yes, I can confidently say that transmitting information between two companies with the same owner is "ok" and should be expected.
I think that's splitting hairs, and focusing on the wrong aspect of it. Avast gives clickstream data to a digital marketing company. That company happens to be a subsidiary, so Avast is a digital marketing company. The problem becomes one not of a company sharing your private information with another so it can me monetized, but the initial company monetizing it itself. If you have a problem with your data being used for marketing by your AV vendor, whether it's shared to make it happen is likely of little consequence to you.
And there are other risks to users. Once that data has been collected, others may access it, and use it in far more damaging ways. Users in China or Saudi Arabia, for example, may end up in jail, or worse.
Not certain of specifics of this case but in general absolutely no! As a data controller you collect users' data for a purpose. If you use that data for a seprate purpose you need seperate consent from users to use their data.
Its tempting to counter with something snarky like a good "whoosh!", but maybe a better response would be to remember that human beings write science fiction and fantasy.
Just a subsidiary.