Centric Health Ltd

Introduction .................................................................................................................................... 4 B. Legal Framework for the Inquiry and the Decision ......................................................................... 4 i) Legal Basis for the Inquiry ........................................................................................................... 4 ii) Data Controller ............................................................................................................................ 4 iii) Legal Basis for the Decision ......................................................................................................... 5 C. Factual Background ......................................................................................................................... 5 D. Scope of the Inquiry and the Application of the GDPR ................................................................. 12 E. Centric’s Submissions in relation to the Draft Decision ................................................................ 14 F. Issues for Determination............................................................................................................... 15 G. Analysis of the Issues for Determination ...................................................................................... 16 a) Assessment of the Risks ............................................................................................................ 16 b) Measures Implemented by Centric to Address the Risks ......................................................... 19 c) Processes to test, assess and evaluate effectiveness of measures .......................................... 27 H. Findings Regarding Article 5(1)(f) and 32(1) ................................................................................. 28 I. Accountability Principle ................................................................................................................ 29 J. Finding Regarding Article 5(2)GDPR ............................................................................................. 30 K. Decision on Corrective Powers ..................................................................................................... 30 L. Reprimand ..................................................................................................................................... 31 M. Administrative Fines ................................................................................................................. 31 Article 83(2)(a) GDPR: the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; ...................................................................... 33 The nature of the infringement ..................................................................................................... 34 The gravity of the infringement .................................................................................................... 34 The duration of the infringement .................................................................................................. 35 Article 83(2)(b) GDPR: the intentional or negligent character of the infringement; ..................... 35 Article 83(2)(c) GDPR: any action taken by the controller or processor to mitigate the damage suffered by data subjects; ................................................................................................................