The German Federal Court of Justice (Bundesgerichtshof), tasked with resolving a conflict between two competing pharmacists, sought guidance from the Court of Justice of the European Union ("CJEU") on interpreting the General Data Protection Regulation ("GDPR"). The defendant’s business sells over-the-counter ("OTC") medicinal products online. During the ordering process, customers must provide certain information, including their name, delivery address, and details about the relevant OTC product. Invoking German legislation on unfair commercial practices, the claimant, a competitor, asked the German courts to halt this practice of the competing pharmacy, unless there is assurance that customers give prior consent for the processing of their health-related data.
The courts at both the first and second instance determined that the ordering process involves processing of health data, which is prohibited under the GDPR in the absence of explicit customer consent or other justification. The courts found this practice to be in breach of the GDPR, and thus unfair and unlawful under the German Unfair Competition Act. The German Federal Court of Justice sought clarification on whether the GDPR allows national legislation to permit competitors to initiate legal action against a person allegedly violating the GDPR. Furthermore, it inquired if the information provided during the ordering process qualifies as health data under the GDPR, even though the relevant OTC products do not require a prescription.
In its judgement of October 4, 2024, the CJEU provided clarity on these issues.
Key Takeaways
First, the CJEU concluded that the GDPR does not bar national laws from enabling competitors to legally contest alleged data protection violations as unfair commercial practices in front of civil courts. This legal avenue is available to competitors in addition to the intervention powers of supervisory authorities responsible for GDPR enforcement and the remedies provided to data subjects under the GDPR. In the CJEU’s view, the GDPR does not aim to fully harmonize legal remedies for GDPR breaches or exclude competitors from filing lawsuits based on national laws against unfair commercial practices. While an injunction by a competitor primarily seeks to ensure fair competition, it may also aid in the compliance with GDPR provisions, thereby strengthening the rights and protection of affected individuals. Such injunctions, akin to those filed by consumer protection associations, can effectively prevent GDPR infringements, the CJEU states.
Second, the CJEU held that the above-mentioned information entered by pharmacy customers when ordering OTC products online constitutes health data within meaning of the GDPR. According to the CJEU, this data can reveal information about the health status of an identified or identifiable person because a link is established between the person placing the order and a medicinal product and its use cases. In the court’s view, this holds true even in the absence of a prescription and considering that the customer may place the order for another person.
Impact on Businesses
In its reference for a preliminary ruling, the German Federal Court of Justice assumed that the GDPR provisions applicable to the processing of health data qualify as market conduct rules within the meaning of the German Unfair Competition Act. Violations of such provisions entitle competitors to assert claims for injunctive relief. It remains to be seen to what extent further provisions of the GDPR will be classified as market conduct rules in the future, as was the case under the German data protection legislation preceding the GDPR. Given the broad notion of health data set out in the CJEU judgment, affected businesses, such as pharmacies selling OTC products online, will need to review their data practices.
Now that the CJEU has cleared the way, it is to be expected that civil claims for data protection violations by competitors will rise in Germany. Businesses should therefore be prepared for legal action by competitors when implementing new products and services, and ensure compliance with data protection law. Since unfair competition law often involves requests for preliminary injunctions, it is particularly important to be able to respond appropriately to legal action at short notice. Preparatory measures include, among others, having litigation counsel readily available or filing protective writs in advance.
Jonas Huber, a Referendar at White & Case, Frankfurt/London assisted in the development of this publication.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2024 White & Case LLP
