The ECJ ruling in Lindenapotheke from 4 October 2024 clarifies right of competitors to sue for GDPR violations and what constitutes health data.
The background
Case C-21/23 before the European Court of Justice concerns a dispute between two pharmacy operators in Germany. One of the parties sold non-prescription but pharmacy-only medicines via an online marketplace platform. The competitor of this seller filed a lawsuit, claiming that the seller had violated data protection regulations by processing customers’ health data without obtaining the required consent. The key questions before the court were whether the data collected—such as name, delivery address, and ordered medicines—constituted “health data” under Article 9 GDPR and, if yes, whether competitors could take legal action in relation to any related GDPR breaches. Another issue was whether the sale of non-prescription medicines falls under the scope of Article 9 GDPR.
The opinion of the Court
The ECJ ruled on two major points:
Competitors’ right to take legal action for GDPR violations
The ECJ clarified that the GDPR does not preclude national legislation that allows competitors to take action against data protection violations, even where they are not impacted data subjects, controllers or processors – essentially where they are third parties as far as the processing operations are concerned. This applies particularly when the breach also constitutes an unfair commercial practice: if the competitor is disadvantaged by the breach they may take legal action against the alleged offender. Therefore, alongside the rights of data subjects and the supervisory authorities, competitors can also pursue civil proceedings for data protection violations subject to national law.
Processing of personal data in medicine sales
The ECJ further ruled that customer data collected when purchasing non-prescription medicines – such as name, delivery address, and product details – is considered “health data” for GDPR purposes. The ECJ said that even basic information about standard pharmaceutical products can reveal information about customer health and is therefore special category data under Article 9 GDPR. An exemption to the general prohibition on processing special category data is therefore required (in this case, explicit consent to the processing). This analysis by the ECJ suggests a broad interpretation of what constitutes health data beyond pure health-related information.
Practical recommendation
This ruling has broad implications for businesses operating in the online health product and medicine market, as well as for handling personal data. Organisations should consider the following points:
- Competitor lawsuits for GDPR violations: businesses should be aware that GDPR violations can be challenged not only by Supervisory Authorities but also by competitors where national law allows. Strict compliance with the GDPR is, therefore, essential for maintaining a competitive edge. Competitors affected by breaches could successfully initiate civil proceedings.
- Processing of health data: The ECJ clarified that the sale of non-prescription but pharmacy-only medicines involves the processing of health data. This understanding of the scope of Article 9 GDPR is quite broad. Relevant businesses should review their purchase processes and the processing of personal data collected with such purchases. Businesses selling non-prescription pharmacy only products must ensure they obtain explicit consent from customers before processing their data, particularly regarding sharing information with third parties like platforms. Online marketplaces must review their processes for the onboarding of sellers and product catalogues to ensure compliance in the processing of potential health data sets of customers. Breaches of these requirements can be challenged both by Supervisory Authorities and competitors.
This ruling sheds light on what constitutes health data. It also underscores the importance of GDPR compliance not only in relation to customers but also in relation to competition with other businesses, as well as the correlation between data protection and consumer protection law. The ECJ said this kind of action actually strengthens data protection in that it provides another avenue by which data subject rights can be protected as GDPR violations can be successfully challenged not only by affected individuals but also by competitors.
