Hi. Your post is a bit difficult to make out but on fourth time of reading, I think I get it;
1. If Company A is gathering the data, it may well be a Data Controller itself
2. What purpose does the State agency, Company B, fill? What is the relationship/contract between companies A and B?
All state agencies operate within legislation and specific purposes. There needs to be a contract/agreement in place between the 2 to operate under existing DP law.
3. Although legislation is not retrospective, the law on data protection is in force for over 15 years and the principles apply pre GDPR as well as after GDPR.
If you could be more specific, and I realise that may not be possible here, we could know better what the circumstances require in your case. You can PM me if you want. Slim