Internet Explorer 11 (IE11) is not supported. For the best experience please open using Chrome, Firefox, Safari or MS Edge

Background

A pharmacy (Lindenapotheke) had been marketing products on Amazon. These products could only be sold by pharmacies, but did not require a prescription. Lindenapotheke’s competitor, DR, sought an injunction prohibiting this practice on the basis it was an unfair commercial practice. DR argued that Lindenapotheke had infringed the GDPR by processing customers’ health data without their consent.

Two questions were ultimately referred to the Court of Justice of the European Union (CJEU)[1]:

  1. Do orders for non-prescription medicines amount to ‘health data’ under Article 9 GDPR, and
  2. Can competitors bring legal proceedings for GDPR infringements?

Question 1 – what constitutes ‘health data’?

The CJEU confirmed that where the data on purchases of medicinal products allow conclusions to be drawn as to the health status of an identified or identifiable person, it must be regarded as data concerning health. The CJEU referred to previous judgments, including Lindqvist [2], OT [3] and Bundeskartellamt [4]. It confirmed that the concept of ‘data concerning health’ must be interpreted broadly.

This approach aligns with the GDPR’s objective to ensure a high level of protection for individuals. On this basis, the CJEU said there was no basis to distinguish between prescription and non-prescription medicinal products.

The CJEU found that data entered on online platforms when ordering pharmacy-only medicinal products is health data where “a link” can be established between:

  • The product
  • Its therapeutic indications or use, and
  • A natural identified or identifiable person

The CJEU made clear that absolute certainty was not required. Article 9(1) would apply where there was a certain degree of probability that the medicinal products are intended for those customers. The CJEU also reiterated that Article 9 is triggered irrespective of whether the information is accurate or falls within the controller’s stated aims.

The CJEU confirmed that a link could also arise even where the products are intended for someone other than the customer. This applies if it is possible to identify the individual and draw conclusions as to the state of their health. An example given is where the customer refers in the order to a family member.

On this basis, the CJEU concluded that customer information processed when ordering medicinal products online “such as their name, the delivery address and the details required for individualising the medicinal products, constitutes data concerning health, within the meaning of those provisions, even where the sale of those medicinal products does not require a prescription” [5].

Question 2 – can competitors bring legal proceedings for GDPR infringements?

The CJEU stated that the GDPR does not prevent national laws from allowing this to occur. The CJEU noted that these types of actions are particularly effective in protecting data subjects. This is because they can help prevent a large number of infringements.

Conclusion

This case is another important ruling on Article 9 GDPR. It underlines the broad interpretation that will be applied to health data, and other special categories of data. The CJEU has reiterated that the controller’s stated purpose and the accuracy of information are not relevant as to whether Article 9 applies. The key issue is whether there is a link of sufficient certainty between the information and an individual. This link must allow conclusions to be drawn about the person’s health. The case is also noteworthy as it clarifies that competitors are not prevented from bringing legal proceedings for unfair commercial practices based on GDPR infringements. This could present a significant avenue to challenge the actions of those engaging in unfair practices which infringe the GDPR.

For more information and expert advice, please contact a member of our Privacy & Data Security team.

The content of this article is provided for information purposes only and does not constitute legal or other advice.

1. Case C-21/23 Lindenapotheke, (4 October 2024) please see here.

2. Case C-101/01, Lindqvist, (6 November 2003) please see here.

3. Case C-184/20, OT, (1 August 2022), please see here.

4. Case C-252/21, Bundeskartellamt (4 July 2023), please see here.

5. Para, 94



Share this: