A product manager launched a feature without a DPIA or data protection by design. The supervisory authority did not wait.