Action under the Unfair Competition Act by competitor permissible in the event of violation of data protection law
ECJ judgment (C-21/23 – ‘Lindenapotheke’) of October 4, 2024.
Background:
The defendant is the owner of a pharmacy and has been selling pharmaceutically-only products via Amazon since 2017. When placing an order through Amazon, customers are required to provide information such as their name, delivery address and the information necessary to personalise the pharmaceuticals. A competitor, who is also a pharmacist, considered the processing of such data to be unlawful under the General Data Protection Regulation (GDPR) and brought an action for unfair competition under Section 3(1) of the German Unfair Competition Act (UWG) before the Regional Court of Dessau-Roßlau. The court granted the claim, and the appeal was also dismissed by the Oberlandesgericht Naumburg. The defendant then appealed to theFederal Court of Justice (BGH). The BGH referred two questions to the ECJ for a preliminary ruling:
- First, the BGH wanted to know whether actions against competitors for breaches of data protection can also be based on competition law and thus on the prohibition of unfair commercial practices. According to the GDPR, the national supervisory authorities and the parties concerned, in this case the pharmacy's customers and consumer associations, are responsible for monitoring and enforcing the provisions of the GDPR.
- On the other hand, the BGH sought clarification on whether the input data provided by customers when ordering non-prescription pharmaceuticals online, which are only available in pharmacies, constitute health data within the meaning of Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR.
ECJ ruling:
The ECJ concluded that the provisions of Chapter VIII of the GDPR permit national legislation to grant competitors the right to initiate civil actions against data protection violations. This right exists in addition to the powers of data protection supervisory authorities and the legal remedies available to data subjects or consumer protection organizations. Consequently, competitors can pursue civil actions against GDPR violations by other companies as part of actions related to unfair commercial practices.
Furthermore, from the ECJ's perspective, data entered by customers when ordering pharmaceuticals online, which are only available in pharmacies, is considered as health data, even if a doctor's prescription is not required for the order. This is because it cannot be excluded that these individuals could be identified, and conclusions could be drawn about their state of health.
This decision by the ECJ further strengthens data protection law. In recent times, numerous compensation claims have already been filed by consumers in connection with GDPR violations, even if they were often not justified. As a result, compliance with data protection regulations is becoming an even greater focus for competitors, provided that they have done their legal homework.
The Maucher Jenkins team is happy to advise you on data protection and competition law issues.
