Prior to the fine being issues, an employee accessed the health data of a concerned person. During the investigation, the data protection authority discovered that the company had infringed upon Article 32 (2) and (4) of the GDPR because it hadn't employed the necessary organizational and technical measures to that ensure no unauthorized access was allowed. 
prior to the  being issues an employee accessed the health data of a concerned person during the investigation the data protection authority discovered that the company had infringed upon cle  and of the  because it hadnt employed the necessary organizational and technical measures to that ensure no unauthorized access was allowed 
prior     issue  employee access  health data   concern person   investigation  data protection authority discover   company  infringe upon cle        hadnt employ  necessary organizational  technical measure   ensure  unauthorized access  allow 