A DPO Who Is Also VP of IT Security at a Digital Therapeutics Company
Helios Health is a 900-employee digital therapeutics company in Amsterdam. Its DPO, appointed voluntarily in 2021, is also the VP of IT Security and reports to the CTO; she chairs the security committee and signs off on penetration-test remediation. The company markets a wellness app with a hospital partner, Sint Lucas, which sets the purpose for a shared patient-engagement programme and receives aggregated dashboards; Helios also uses a Manila-based support vendor with 140 agents who have live access to user records. The vendor contract has no audit right and no sub-processor list. The CMO wants the DPO to approve a new 'lookalike audience' feature before Friday's launch, and the board asks who is accountable if the hospital partner suffers a breach. The DPO has 0.4 FTE allocated and no independent budget.
1. Analyze the DPO conflict of interest and independence. What must change, and is the appointment invalid?
Read the worked answer
Conflict test: Art 38(3) prohibits the DPO from holding a position that determines the purposes or means of processing. A VP of IT Security who chairs the security committee and signs off on remediation determines means and controls security budget, so the combination creates a structural conflict. Reporting to the CTO, whose function is a major processing area, undermines independence under Art 38(3) and EDPB Guidelines 07/2020. The DPO must not receive instructions on DPO tasks, must not be dismissed for performing them, and must report to the highest management level.
Is the appointment invalid? Not automatically. The appointment is non-compliant and must be remedied, but the DPO's acts are not void solely because of the conflict. The company should split the roles, or retain the DPO title only if the security duties and security budget ownership are removed and reporting moves to the CEO or board. A 0.4 FTE allocation for a 900-person company with a hospital programme and a 140-agent vendor is hard to defend as adequate resourcing; document the resourcing assessment and the change.
Conclusion: The DPO can advise on the lookalike feature, but cannot approve it as a business owner. The conflict must be removed, not papered over, and the board should record the remediation.
2. Map the controller, processor, and joint controller roles for the hospital programme and the support vendor, and explain who is accountable for what.
Read the worked answer
Hospital programme: Sint Lucas sets the purpose (patient engagement) and likely determines essential means; Helios supplies the platform and dashboards. If Helios negotiates the purpose or essential means jointly, they are joint controllers and need an Art 26 arrangement describing the allocation. If Helios only processes on instructions, it is a processor. Aggregated dashboards may be anonymous, but aggregation is not a magic wand; re-identification risk must be assessed, and if the hospital can single out patients, the data is still personal.
Support vendor: processor under Art 28, with Helios as controller for its app data. The Manila location requires a transfer mechanism under Art 46 and Art 28(3) terms. If the vendor uses data for its own quality assurance or analytics, it becomes a controller for that purpose. The missing audit right and sub-processor list are Art 28(3)(a), (d), and (h) failures.
Accountability: joint controllers are each accountable to data subjects; the internal Art 26 allocation does not bind them. The board should understand that Helios remains responsible for processor oversight and for its own purposes, not for the hospital's independent use. The board should also understand that accountability is not transferred by contract; it follows the facts of control.
3. Advise on the CMO's request to approve the lookalike feature before Friday and on the vendor gaps. What should be done first?
Read the worked answer
CMO request: the DPO's role is to advise and monitor, not to give business sign-off; doing so deepens the conflict and makes the DPO a decision-maker. The correct response is a written advice note: lookalike audiences using hashed customer emails are still personal data; the lawful basis must be identified, transparency updated, and e-marketing consent checked. Friday is not a legal basis. If the feature involves 'sharing' under CCPA/CPRA or electronic marketing, additional opt-out or consent requirements apply.
Vendor gaps: no audit right, no sub-processor list, no documented instructions, and no transfer analysis are Art 28(3) failures. Prioritize by risk: (1) suspend new or expanded processing that depends on the vendor until a DPA is in place; (2) obtain the sub-processor list and notify or approve it; (3) require security and audit rights; (4) restrict the 140 agents to least-privilege, monitored access; (5) document the transfer.
Conclusion: the feature can launch only after a lawful-basis and transparency review and a signed DPA. The DPO should escalate the resource and reporting issues to the board in writing, and the board should record its decision on the launch risk.