Virtue Integrated Elder Care Ltd

Introduction .................................................................................................................................... 4 B. Legal Framework for the Inquiry and the Decision ......................................................................... 4 i) Legal Basis for the Inquiry ........................................................................................................... 4 ii) Data Controller ............................................................................................................................ 4 iii) Legal Basis for the Decision ......................................................................................................... 5 C. Factual Background ......................................................................................................................... 5 D. VIEC’s submissions in relation to the Draft Decision .................................................................... 10 E. Scope of the Inquiry and the Application of the GDPR ................................................................. 12 F. Issues for Determination............................................................................................................... 15 G. Analysis of the Issues for Determination ...................................................................................... 16 a) Assessment of the Risks ............................................................................................................ 16 b) Measures Implemented by VIEC to Address the Risks ............................................................. 19 c) Processes to Test, Assess and Evaluate Effectiveness of Measures ......................................... 23 H. Findings ......................................................................................................................................... 25 I. Decision on Corrective Powers ..................................................................................................... 25 J. Order to Bring Processing into Compliance .................................................................................. 26 K. Reprimand ..................................................................................................................................... 27 L. Administrative Fine ....................................................................................................................... 27 Article 83(2)(a) GDPR: the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; ....................................................................... 29 The nature of the infringement .................................................................................................... 29 The gravity of the infringement .................................................................................................... 29 Article 83(2)(b) GDPR: the intentional or negligent character of the infringement; ........................ 30 Article 83(2)(c) GDPR: any action taken by the controller or processor to mitigate the damage suffered by data subjects; ................................................................................................................. 31 Article 83(2)(d) GDPR: the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32 GDPR; ...........................................................................................................................................