Data protection violations in online retail: ECJ allows lawsuits by competitors

The ECJ has ruled on the extent to which competitors of a company can assert data protection violations under civil law.
Categories:

The decision of the European Court of Justice (ECJ) clarifies, among other things, the extent to which competitors of a company can assert data protection violations under civil law and how the Processing personal Health data in online retailing.

Legal dispute between two competing pharmacists ends up before the BGH

The subject of proceedings C-21/23 was a dispute between two pharmacists regarding the sale of pharmacy-only but non-prescription medicines via the Amazon platform. The Lindenapotheke pharmacy sold its products via Amazon, whereby the customers personal data such as name and delivery address as well as information required for individualization. A competitor filed an injunction against this distribution. The pharmacist claimed that the Consent of customers in the Processing their Health data had not been sufficiently obtained, which would have Infringement against Art. 9 GDPR represent.

The Regional Court and the Higher Regional Court of Naumburg ruled in favor of the competitor in the lower courts. They considered the sale to be an unlawful commercial act under the Unfair Competition Act (UWG). Lindenapotheke then appealed and the case ended up before the Federal Court of Justice (BGH). The BGH ultimately requested a preliminary ruling from the ECJ.

The proceedings focused on two legal questions raised by the BGH, which were answered by the ECJ:

  1. The legal standing of competitors in the event of data protection violations: Does the GDPRthat competitors of a company assert violations of the regulation under civil law?
  2. Classification of data when ordering pharmacy-only medicines online: Are the data entered by the customer in the context of an online order (such as name, address and information on the individualization of the medicinal product) classified as Health data within the meaning of Article 9(1) of the ECJ judgment?

ECJ sets out Health data far out

The ECJ stated in case C-21/23 | Lindenapotheke:

  1. Competitors' right to sue for data protection violations
    The ECJ has clarified that the provisions of Chapter VIII of the GDPR national rules which enable competitors to prevent infringements of the GDPR under the aspect of unfair commercial practices before the civil courts. This gives competitors the right to bring an action, even if they are not directly Affected parties in the sense of GDPR are.

    This decision is particularly important in the area of competition law, as data protection violations can now also be classified as anti-competitive behavior by competitors and prosecuted in court. According to the ECJ, this helps to strengthen the rights of data subjects and guarantee them a high level of protection. "In addition, this may prove to be particularly effective, as it can prevent numerous infringements of the General Data Protection Regulation", the ECJ continued.

  1. Classification of data when ordering pharmacy-only medicines online
    On the second question, the ECJ ruled that data entered when ordering pharmacy-only but not prescription-only medicinal products can be regarded as Health data within the meaning of Art. 9 para. 1 GDPR are to be qualified. It does not matter whether a medicine is subject to prescription or not. This applies regardless of whether the medicines are intended for the purchaser himself or for Third are intended.


    The ECJ clarified that Health data must not only be directly available, but can also be derived indirectly from the information entered. The entry of names, addresses and medication information allows conclusions to be drawn about a person's state of health, which makes this data particularly worthy of protection within the meaning of the GDPR classification.

Reading tip: ECJ defines "legitimate interest" according to Art. 6 para. 1 lit. f GDPR from

Companies beware: Competitors can also be punished for data protection violations

The ECJ's ruling has significant implications in particular for online pharmacies and other companies that process sensitive data. Health data process:

  1. Reinforced Liability due to the legal standing of competitors
    Companies must be prepared for the fact that data protection violations can be prosecuted not only by data subjects or data protection authorities, but also by competitors. This leads to an increased liability risk, as breaches of the General Data Protection Regulation can increasingly be seen as unfair business practices.

    For companies, this means increased scrutiny and compliance with data protection regulations, as economic competitors are also demanding compliance with data protection regulations. GDPR under civil law. This can lead to an increase in legal disputes, particularly in highly competitive markets such as the pharmacy sector.

  1. Sensitization for Health data
    The decision makes it clear that companies that, in the course of their business activities personal data data that indirectly allow conclusions to be drawn about the state of health must be handled with particular care. The Processing such Health data required according to Art. 9 GDPR either the explicit Consent of the data subject or must be based on one of the grounds referred to in Art. 9 (2) GDPR exceptions, such as the provision of healthcare services.

    For online pharmacies, this means that when collecting order data, they must ensure that an effective Consent into the Processing of this data is obtained. It is not sufficient to obtain general declarations of consent. The Consent must expressly refer to the Processing from Health data refer.

The ECJ ruling underlines the importance of comprehensive data protection management in companies. Data protection violations can not only lead to high fines, but also to injunctions by competitors. Companies must therefore optimize their internal processes, particularly with regard to consent and the Processing from Health dataand adjust if necessary.

Source: Judgment of the Court of Justice in Case C-21/23 | Lindenapotheke

Tags:
Share this post :