The paradox of health data and GDPR: is your data worth dying for?