The wellness watch: controller, joint controller, or two controllers?
Meridian Manufacturing NV runs a voluntary wellness programme for its 1,400 Belgian employees. Staff who enrol receive a fitness watch from VitalityTech Ltd (Dublin) and use its app, which records steps, sleep, resting heart rate and location during workouts. Meridian chose the metrics shown in the HR dashboard and set two alerts: an inactivity alert after 14 days without exercise, and a cardiac alert triggered at a resting heart rate above 100 bpm for seven consecutive days. HR raised the cardiac alert in three performance review meetings last quarter. VitalityTech also uses the data in aggregated form to refine its risk scores and sells a 'workforce resilience' benchmark to other employers. 570 employees enrolled; the works council has now objected, and two employees say their team leader pressured them to join. Meridian treats enrolment as consent.
1. Characterise the roles of Meridian and VitalityTech for (a) the HR dashboard and (b) VitalityTech's model development. Justify your answer.
Read the worked answer
Role follows purpose and essential means, not contract labels. Under EDPB Guidelines 07/2020, joint controllership exists where two parties jointly determine the purposes and means; it is not necessary that both access the data.
(a) The dashboard - joint controllers. Meridian determines the purpose (workforce wellness, and in practice performance management), and it determined essential means by selecting the metrics and setting the two alert thresholds. VitalityTech determines the device, the app and the technical collection. Neither would determine this processing alone, and the arrangement affects the same data subjects in the same operation. That is joint controllership, and it requires an Article 26 arrangement allocating responsibilities, plus a joint point of contact for data subjects, without affecting their rights against either party.
(b) Model development and benchmarking - VitalityTech as sole controller. Here VitalityTech sets its own purpose: improving its product and selling benchmarks. Meridian has no say, so this falls outside the joint arrangement and needs its own legal basis and notice. The 'aggregated' defence is weak with 570 employees in identifiable teams: if individuals can be singled out or inferred, the data is pseudonymised, not anonymous (Recital 26).
Consequence: two notices, two bases, one Article 26 arrangement, and an Article 28 contract covering VitalityTech's processing on Meridian's behalf.
2. Is consent an appropriate legal basis? Which Article 9 condition could apply, and what would Meridian have to prove?
Read the worked answer
Consent is theoretically available but structurally fragile here. Consent must be freely given (Article 4(11), Article 7, Recital 43). In an employment relationship there is a presumed imbalance, so the employer must show the programme is genuinely optional, carries no detriment, is not tied to appraisal or pay, and that refusal is recorded without comment. Two employees reporting pressure from a team leader, and an alert reaching performance reviews, undercut precisely that.
Article 9. Resting heart rate and sleep data, combined with the cardiac alert, are health data in practice. The plausible condition is Article 9(2)(a) explicit consent - a clear affirmative statement, granular per metric and per use. Article 9(2)(b) does not rescue it: it needs a Union or Member State law authorising the processing, and Belgian law does not provide a general wellness-processing mandate. Article 9(2)(h) does not apply, because this is not preventive or occupational medicine delivered by a professional.
What must be proven: granular opt-in, a real ability to withdraw without losing anything, no team-leader involvement in enrolment, no HR use of individual health flags, records of each consent (Article 7(1)), and evidence that the works council process was followed.
If Meridian cannot guarantee freedom from detriment, the honest conclusion is that consent is invalid and the cardiac alert cannot be run at all in its current form.
3. What would you change before the programme continues, and what is the residual risk if it does not change?
Read the worked answer
Redesign, do not reword.
- Remove individual health alerts from HR's view entirely. HR should see only aggregated, small-cell-suppressed participation statistics.
- Delete the cardiac alert or have it handled by an occupational health professional under a legal obligation, with no management visibility.
- Re-onboard with unticked, separate opt-ins per metric and per purpose, with a visible withdrawal button, and require enrolment to be handled by HR services rather than line managers.
- Stop collecting location during workouts if it adds nothing to the stated purpose; minimise retention.
- Sign the Article 26 arrangement and an Article 28 contract with VitalityTech, publish layered notices for both processing purposes, and run an Article 35 DPIA - health data, vulnerable data subjects, systematic monitoring and innovative technology all point to high risk.
- Consult the works council as required by Belgian collective law, and record the outcome.
Residual risk if unchanged: Article 83(5) exposure (up to EUR 20 million or 4% of global turnover) for processing special category data without a valid condition; the Belgian DPA has treated employee-monitoring and consent-under-pressure cases seriously. Add individual compensation claims under Article 82 for non-material damage, works council litigation, and an employment-law problem: performance decisions resting on health data are likely unlawful discrimination. The reputational cost of an enforced shutdown mid-programme is usually higher than the redesign.