- The ECJ confirms that member states can allow complaints from competitors based on competition law under the GDPR.
- Personal details in online orders for pharmacy-only medicines are considered health data if they allow conclusions to be drawn about the patient’s state of health.
- This classification applies regardless of whether the order is placed for the user himself or for a third party.
The present ruling of October 4, 2024 (C‑21/23 i.S. Lindenapotheke) concerns the operator of the Linden pharmacy, which sells pharmacy-only medicines via Amazon. A competitor had applied for a ban if customers did not consent to the processing of the relevant data. The German Federal Court of Justice had referred questions to the ECJ in the corresponding proceedings.
The ECJ first confirms that the GDPR does not prohibit member states from Competitor complaints based on competition law to allow:
- The processing of personal data is of great economic importance. It is therefore possible that compliance with data protection law is relevant to competition (which has already been confirmed by the ECJ in the Bundeskartellamt case, Case No. C‑252/21).
- Art. 80 (2) GDPR (Member States may regulate the right of certain organizations to lodge complaints) is an opening clause. Even if there is no mention of competitor complaints, no full harmonization is intended here. Competitor complaints can also strengthen the effectiveness of the GDPR. For this reason and for other considerations, the GDPR allows the Member States to allow competitor complaints based on competition law.
The second point is much more relevant in practical terms, the Scope of the concept of health data. The BGH had asked whether data from the online ordering of medicines (such as name or delivery address) is health data. This is the case if conclusions about the state of health “can be drawn” from the data. However, it is sufficient if such conclusions can be drawn indirectly:
82 In particular, these provisions [especially Art. 9 para. 1 GDPR] cannot be interpreted as meaning that the processing of personal data that is Indirectly sensitive information about a natural person is excluded from the enhanced protection provided for in these provisions […].
83 In order for personal data to be classified as health data within the meaning of Art. 8 para. 1 of Directive 95/46 and Art. 9 para. 1 GDPR, it is therefore sufficient that these data by means of mental combination or derivation the state of health of the person concerned can […].
This should apply prima vista to order data:
84 From the data that a customer enters when ordering pharmacy-only medicines via an online platform, can be used to infer the state of health of the person concerned […] by means of a mental combination or deductionas the order establishes a link between a medicinal product, its therapeutic indications and uses and an identified natural person or a natural person identifiable by details such as name or delivery address.
However, the BGH was unsure here because orders can also be placed for third parties. The ECJ does not agree:
88 Accordingly, if a user of an online platform transmits personal data when ordering pharmacy-only but non-prescription medicines, the processing of this data by the operator of a pharmacy that sells these medicines via the online platform is to be regarded as processing of health data […], since the processing of this data may reveal information about the state of health of a natural person, regardless of whether this information concerns the user or another personfor which this order is placed […].
The ECJ uses the all-purpose weapon of data protection law to justify its decision:
89 An interpretation of those provisions which differentiates according to the nature of the medicinal products concerned and whether their sale requires a medical prescription would not be consistent with the objective, set out in paragraph 81 of the present judgment, of a high level of protection. […]
Therefore:
90 Consequently, the information entered by a pharmacy operator’s customers when ordering pharmacy-only but non-prescription medicines online constitutes health data […] […].