With its decision of March 27, 2025, the First Civil Senate of the Federal Court of Justice (BGH) answered a fundamental question of practical relevance at the interface of data protection and unfair competition law: The inadmissible Processing personal Health data in connection with the online distribution of medicinal products not only establishes a Infringement against the General Data Protection Regulation (GDPR), but may also constitute an unfair commercial act within the meaning of Section 3a UWG. In these cases, competitors are entitled to injunctive relief under competition law.
Pharmacists' dispute over online trade in medicines
The proceedings centered on the practice of pharmacists who sell pharmacy-only medicines via Amazon Marketplace. The plaintiffs - also pharmacists - complained that the defendants in the context of order processing personal data their customers without their express Consent processed. Specifically, this involved data such as name, delivery address and other sensitive information to individualize the medicines. The plaintiffs claimed that this was Health data within the meaning of Art. 9 para. 1 GDPR whose Processing without explicit Consent was inadmissible. In proceedings I ZR 222/19, it was also complained that shipping via Amazon violated pharmacy and medicinal product regulations as well as professional regulations. The plaintiffs each sought injunctive relief and, in proceedings I ZR 222/19, also damages.
The lower courts upheld the actions with regard to the claim for injunctive relief under data protection law. With regard to the asserted violations of other legal provisions and the claim for damages, the claims were partially dismissed.
The BGH initially suspended the proceedings I ZR 223/19 and referred questions to the Court of Justice of the European Union (CJEU) on the interpretation of Art. 9 GDPR in connection with the online trade in medicinal products for a preliminary ruling. In its ruling of October 4, 2024 (C-21/23 - Lindenapotheke), the ECJ confirmed that the ordering of non-prescription medicines can also be Health data in the sense of GDPR and whose Processing in principle an explicit Consent is required. The proceedings were continued following the ECJ's decision.
Reading tip: Data protection violations in online retail - ECJ allows lawsuits by competitors
Injunctive relief under competition law after GDPR infringement
In its decision, the Federal Court of Justice clarified that the Processing of order data in connection with the purchase of medicinal products in order to Health data within the meaning of Art. 9 para. 1 GDPR regardless of whether the medicine is available on prescription or not. The special need for protection arises from the inference of specific or potential health conditions of the person concerned. Since the Processing of this data in the present case without explicit Consent of the customers concerned, there was a clear Infringement against the GDPR before.
At the same time, the BGH states unequivocally that Art. 9 para. 1 GDPR constitutes a rule of market conduct within the meaning of Section 3a UWG. The purpose of this provision is, among other things, to protect the consumer when participating in the market, in particular with regard to his right to Informational self-determination. The decision on the disclosure of Health data within the framework of a contractual relationship is a central component of the protected Privacy. A Infringement A breach of this obligation is therefore likely to prejudice the interests of competitors and could be the subject of an action for an injunction under competition law.
As a result, the defendants' appeals were unsuccessful insofar as they were directed against their order to cease and desist. The plaintiff's appeal in proceedings I ZR 222/19 was only successful insofar as the claim for damages was dismissed. Otherwise, this appeal was also dismissed.
Effects on practice
The decision of the BGH is of considerable importance for the practice of e-commerce and in particular for the digital distribution of healthcare products. The BGH explicitly affirms the relevance of breaches of data protection regulations under competition law - a line that has already been taken in previous decisions on the quality of market conduct rules, such as Art. 6 (1) GDPR. GDPR (e.g. Facebook Fanpages, Planet49), but has now turned its attention to the particularly sensitive Health data is extended.
Also noteworthy is the clarification on the classification of orders for medicinal products as Processing special categories of personal data. Companies that previously assumed that only medical prescriptions were covered by Art. 9 GDPR will have to rethink their data processing procedures.
The decision also strengthens the position of competitors in the context of private law enforcement. In contrast to the often sluggish administrative practice of the data protection supervisory authorities, this opens up an effective way of sanctioning data protection violations via fair trading law. Companies can no longer rely on a lack of complaints from data subjects leading to inaction. A claim for injunctive relief under competition law thus indirectly expands the possibilities for sanctioning a breach of data protection law.
Source: BGH rulings from March 27, 2025 - I ZR 222/19 and ZR 223/19
German 
English 
Italian 
French