Helio Health: A US Subpoena, an Employee Access Request, and a Stale Transfer Assessment
Helio Health is a Netherlands-based medical device company with 4,300 EU employees. HR data sits in a shared system administered by the Boston parent. The 2021 standard contractual clauses with the parent are signed, but the transfer impact assessment has not been reviewed since 2022 and no supplementary measures were implemented. The US parent's legal team receives a regulator subpoena demanding 'all records' for 12 named EU employees. In the same week, one of those employees submits an access request seeking every email that mentions her name, including her manager's handwritten performance notes, which reference a contemplated disciplinary process. The CEO asks whether the parent can simply 'send everything and let the Dutch team know afterwards'.
1. How should the company respond to the US subpoena? Identify the conflict of laws and the practical steps.
Read the worked answer
The premise to reject. A US subpoena does not, by itself, make an EU transfer lawful. GDPR Article 48 provides that foreign judgments and decisions requiring transfer are enforceable only on the basis of an international agreement. A regulator's compulsion is not a blank cheque.
Steps:
- Validate and narrow. Confirm the subpoena's issuing authority, scope and deadline; negotiate to limit to the 12 named employees and to what is genuinely responsive.
- Route through a lawful mechanism. Prefer mutual legal assistance or a direct regulator-to-regulator request. Failing that, rely on a Chapter V transfer tool, and note the 2021 SCCs require the importer to challenge a request that is overbroad or not a legally binding demand, and to notify the exporter.
- Apply Article 6 and Article 49 logic. Is disclosure necessary for compliance with a legal obligation? Proportionate? Can it be met with pseudonymised or aggregated data?
- Minimise and document. Produce the least data that satisfies the demand, redact third-party and special-category content, log what was withheld and why.
- Notify. Tell the Dutch supervisory authority and the affected employees unless a genuine, narrow prohibition applies.
Answer to the CEO: 'Send everything first and tell them later' is the wrong order and creates the very breach evidence the regulator would look for. The sequence is: validate, narrow, transfer under a tool, notify, record.
2. Is the employee entitled to the emails and the manager's performance notes? Analyse scope, third-party rights and the contemplated disciplinary process.
Read the worked answer
Framing. Access is to personal data undergoing processing, not to documents as such. The test is whether information relates to an identified or identifiable individual - which includes opinions and assessments about her, not only factual records.
Emails mentioning her name. Not all qualify. Where she is merely copied or mentioned in passing in a discussion of someone else, the data relate to the other person. Where the email evaluates her work, conduct or performance, it is her personal data. A defensible approach is a keyword search followed by a relevance review, not a dump.
Manager's notes. Likely her personal data, including subjective assessments. The right of access covers the content of the assessment, but not necessarily the physical note as an artefact, and not internal drafts if they have no bearing on the final assessment.
Third-party data. Names and opinions of colleagues are normally redacted unless the colleague consents or the information is indispensable to her understanding. The exception is narrower when the third party is the source - but do not use that exception to strip out the substance of a criticism she needs to understand.
Contemplated disciplinary process. If litigation or a formal process is reasonably in prospect, a legal privilege or legal-claims exemption may apply to specific documents. It is a document-by-document claim, not a blanket refusal, and must be logged.
Timing: one month, extendable by two for complexity, with the employee informed of the extension and reasons.
Practical warning: this request is likely a precursor to a claim. Suspend routine deletion for the relevant custodians now.
3. What governance remediation should the board approve, and in what order?
Read the worked answer
Order matters more than completeness - fix what is currently unlawful first.
- Re-paper the transfer now. Refresh the transfer impact assessment; check whether the parent is certified under the EU–US Data Privacy Framework (if so, that is the simplest route); if not, implement supplementary measures: encryption with keys held in the EU, pseudonymisation, and EU-based administration for HR data.
- Lock down administrative access so the Boston team cannot browse EU HR records by default; access on request, logged.
- Set a public-authority request procedure - a single intake, legal review, challenge obligation, notification to the exporter, and a register of requests received and dispositions.
- Build a repeatable access-request workflow with search, review, redaction and logging so the next request is not a project.
- Retention schedule for HR and disciplinary files, so 'we hold everything forever' stops being the answer.
- Board reporting: risk register entry, owner, and a date for independent assurance.
What not to do: buy a new tool and call it compliance. The failure here was governance - a transfer assessment nobody revisited - not technology.