- Subcontractor based in India to process sensitive personal data without adequate data processing / data transfer grounds
- Lack of contractual definition of adequate technical and organisational measures in India
- Sensitive personal data (with high severity) sent via unencrypted email
- Sensitive personal data on FTP server without restricted access controls
- Patient found his/her data via Internet search
[protecting people by good design, solid security, efficient processes and trusted services]