The ECJ has dealt with the strict conditions for the processing of health data. Such data enjoys increased protection. With regard to claims for damages under the GDPR, this serves a compensatory function, not to punish the controller.