My medical data has leaked — what now?

Medical data falls under special category data (GDPR Art. 9) and receives the highest protection. On a breach fines are higher (Art. 83(5)) and the notification duty is stricter. On high risk the healthcare provider must inform you directly (Art. 34) — not just notify the AP. Two parallel routes: (1) Complaint at the healthcare provider itself + IGJ for the quality/care aspect. (2) AP complaint for GDPR enforcement + civil claim Art. 82 for damages. Damage amounts in Dutch case law: medical data leaks typically receive €1,000-€5,000 in non-material damages — higher than regular data because the impact (privacy + reputation + possible discrimination) is greater. Important: keep all correspondence. IGJ + AP often share information — one complaint feeds investigations at both.