The data protection authority discovered that the hospital had not complied with the information obligations and did not provide adequate processing agreement with the data processor, under Art. 28 GDPR. The incident involved the unlawful disclosing of personal information about participants in a public competition. Because of a configuration error with the platform, the list of codes assigned to the participants was temporarily accessible on the platform, making it easy to access the personal data. The DPA deemed this to be a violation of the principle of protection of information security.
the data protection authority discovered that the hospital had not complied with the information obligations and did not provide adequate processing agreement with the data processor under   the incident involved the unlawful disclosing of personal information about participants in a public competition because of a configuration error with the platform the list of codes assigned to the participants was temporarily accessible on the platform making it easy to access the personal data the dpa deemed this to be a  of the principle of protection of information security
 data protection authority discover   hospital   comply   information obligations    provide adequate process agreement   data processor     incident involve  unlawful disclose  personal information  participants   public competition    configuration error   platform  list  cod assign   participants  temporarily accessible   platform make  easy  access  personal data  dpa deem        principle  protection  information security