Abstract;Judgment — ECLI:EU:C:2024:846
Date: 2024-10-04
Language of the case: German
Court formation: Grand Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Summary C-21/23 – 1 
Case C-21/23 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
19 January 2023 
Referring court: 
Bundesgerichtshof (Federal Court of Justice, Germany) 
Date of the decision to refer: 
12 January 2023 
Defendant and appellant in the appeal on a point of law: 
ND 
Applicant and respondent in the appeal on a point of law: 
DR 
  
Subject matter of the main proceedings 
Action seeking an injunction to prevent the sale of pharmacy-only medicines via 
the Amazon online trading platform without obtaining the customer’s prior 
consent to the collection, processing and use of his or her health data 
Subject matter and legal basis of the request 
Interpretation of EU law, in particular Regulation (EU) 2016/679 and Directive 
95/46 EC; reference pursuant to Article 267 TFEU 
Questions referred 
1. Do the rules in Chapter VIII of the General Data Protection Regulation 
preclude national rules which – alongside the powers of intervention of the 
supervisory authorities responsible for monitoring and enforcing the 
regulation and the options for legal redress for data subjects – empower 
competitors to bring proceedings for infringements of the General Data 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-21/23 
 
2  
Protection Regulation against the infringer before the civil courts on the 
basis of the prohibition of unfair commercial practices? 
2. Do the data that the customers of a pharmacist who acts as a seller on an 
online sales platform enter when ordering pharmacy-only but not 
prescription-only medicines on the sales platform (customer’s name, 
delivery address and information required for individualising the pharmacy-
only medicine ordered) constitute data concerning health within the meaning 
of Article 9(1) GDPR and of Article 8(1) of the Data Protection Directive? 
Provisions of European Union law relied on 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (GDPR), in 
particular Article 9(1) and Chapter VIII  
Directive 95/46/EC of the European Parliament and of the Council of 24 October 
1995 on the protection of individuals with regard to the processing of personal 
data and on the free movement of such data (OJ 1995 L 281, p. 31) (Data 
Protection Directive), in particular Article 8(1) 
Provisions of national legislation 
Gesetz gegen den unlauteren Wettbewerb (Law against Unfair Competition, ‘the 
UWG‘), in particular Paragraphs 3, 3a, 8 
Bundesdatenschutzgesetz (Federal Law on Data Protection, ‘the BDSG’) in the 
version applicable until 24 May 2018, in particular Paragraphs 4, 4a, 28 
Brief summary of the facts and procedure 
1 The applicant operates a pharmacy. The defendant is also a pharmacist and 
operates a pharmacy. He is the holder of a mail-order licence and also sells his 
products online. In addition, in 2017, the defendant merchandised his products, 
including pharmacy-only medicines, via the online sales platform ‘Amazon 
Marketplace’ (‘Amazon’). 
2 The applicant objects to the sale of pharmacy-only medicines via Amazon as 
being unfair as it breaches statutory requirements to obtain the customer’s consent 
under data protection law to the collection, processing and use of his or her health 
data. He is seeking an injunction against such sales. 
3 The Landgericht (Regional Court) upheld the action. The appeal court dismissed 
the defendant’s appeal. Through his appeal on a point of law, the defendant 
LINDENAPOTHEKE 
 
3 
pursues his application for the case to be dismissed. The applicant contends that 
the appeal on a point of law should be dismissed. 
Succinct presentation of the reasoning in the request for a preliminary ruling  
4 The success of the appeal on a point of law depends on the interpretation of 
Chapter VIII of the GDPR, Article 9 of the GDPR and Article 8(1) of the Data 
Protection Directive. This turns on whether the applicant, as a competitor, is 
permitted to bring proceedings for infringements of the General Data Protection 
Regulation against the infringer before the civil courts on the basis of the 
prohibition of unfair commercial practices (first question referred). It also depends 
on whether the data that the customers of the defendant are required to enter when 
ordering pharmacy-only but not prescription-only medicines on the sales platform 
(customer’s name, delivery address and information required for individualising 
the pharmacy-only medicine ordered) are data concerning health within the 
meaning of Article 9(1) GDPR and of Article 8(1) of the Data Protection 
Directive (second question referred). 
Consideration of the first question referred 
5 Under the Data Protection Directive, the applicant was permitted, as a competitor, 
to file for injunctive relief through proceedings before the civil courts. According 
to the case-law of the Court, the relevant provisions in Chapter III of the Data 
Protection Directive do not preclude national legislation which allows consumer-
protection associations to bring or defend legal proceedings against a person 
allegedly responsible for an infringement of the protection of personal data 
(judgment of 29 July 2019, Fashion ID, C-40/17, EU:C:2019:629, paragraph 63 
and operative part, paragraph 1). The same applies to the proceedings of a 
competitor, which are at issue here. The Court assumed that Articles 22 to 24 of 
the Data Protection Directive do not amount to an exhaustive harmonisation of the 
national provisions stipulating the judicial remedies that can be brought against a 
person allegedly responsible for an infringement of the laws protecting personal 
data (judgment of 29 July 2019, Fashion ID, C-40/17, EU:C:2019:629, 
paragraph 57). 
6 The first question referred seeks to clarify whether this legal situation changed 
with the entry into force of the GDPR on 25 May 2018. 
7 It is disputed whether, following the entry into force of the GDPR, competitors are 
permitted to bring legal proceedings against infringements of the provisions of 
this regulation. One view assumes that the rules contained in the GDPR to enforce 
the regulation’s data protection provisions are exhaustive; it therefore argues that 
competitors are not permitted to bring proceedings under competition law. 
Another view is that the relevant enforcement provisions set out in the GDPR are 
not exhaustive and that competitors therefore continue to be permitted to assert 
injunction claims by bringing legal proceedings. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-21/23 
 
4  
8 It is not possible to give a clear answer to the question in dispute. 
9 No answer can be inferred from the text of the GDPR, specifically the provisions 
of Chapter VIII thereof, which governs the remedies, liability and sanctions for 
infringements of the regulation’s requirements for the permissible processing of 
personal data. Competitors are not mentioned anywhere in the regulation. 
10 An interpretation that takes into account the systematic context of the GDPR’s 
provisions concerning enforcement does not clearly show either whether the EU 
legislature by this regulation – unlike with the Data Protection Directive – not 
only unified the provisions on the protection of personal data, but also the 
provisions concerning the assertion of the rights existing thereunder. 
11 Articles 57 and 58 of the GDPR provide for the supervisory authorities within the 
meaning of Article 51(1) and Article 4(21) to perform extensive tasks and have 
extensive powers to monitor and enforce this regulation (see also recital 129). 
This could lead to the conclusion that, in principle, the EU legislature assumes 
that the provisions of the regulation are to be enforced through the supervisory 
authorities (‘public enforcement’). The GDPR seeks to ensure the harmonisation 
of national legislation on the protection of personal data which is, in principle, full 
(Court of Justice, judgment of 28 April 2022, Meta Platforms Ireland, C-319/20, 
EU:C:2022:322, paragraph 57). 
12 Moreover, the GDPR provides data subjects with options for legal redress in 
Article 77(1), Article 78(1) and (2) and in Article 79(1). The fact that each of 
these provisions contains the expression ‘without prejudice to any other … 
remedy’ might militate against an exhaustive provision concerning the assertion of 
rights. 
13 It may not be possible, however, to base the permissibility of a right of 
competitors to bring legal proceedings on Article 84(1) of the GDPR, according to 
which Member States are to lay down the rules on other penalties applicable to 
infringements of the regulation and to take all measures necessary to ensure that 
they are implemented. According to the scheme of the GDPR, a right of 
competitors to bring legal proceedings cannot be a ‘penalty’ if only because the 
EU legislature explicitly distinguishes in Chapter VIII of the regulation between 
remedies, liability and penalties and it is apparent from the connection between 
Article 84, Article 83 and recitals 148 to 152 of the regulation that the penalties 
within the meaning of Article 84 of the GDPR concern the administrative and 
criminal penalties applicable to infringements (see Court of Justice, judgment of 
28 April 2022, Meta Platforms Ireland, C-319/20, EU:C:2022:322, paragraph 49). 
14 However, no rule may be inferred from the GDPR that excludes the prosecution of 
infringements of data protection law as unfair commercial practices (see Opinion 
of Advocate General Richard de la Tour in the Facebook Ireland case, C-319/20, 
EU:C:2021:979, paragraph 51). It is therefore questionable whether the GDPR is 
intended to be exhaustive, also with regard to infringements of competition law. 
LINDENAPOTHEKE 
 
5 
15 Nor does the provision’s objective, which is to be considered alongside the text 
and the context of the provision in any interpretation of EU legislation, allow for 
any clear answer to be given to the question referred. 
16 The permissibility of a right of competitors to bring legal proceedings under 
competition law could be incompatible with the objective of unification pursued 
by the EU legislature when creating the GDPR. 
17 Under the Data Protection Directive, there was not only a different level of 
protection in the EU Member States, but there were also differences in the 
enforcement of data protection provisions. It may be concluded from recitals 11 
and 13 of the GDPR that the EU legislature’s objective was to provide a remedy 
with regard to both of these aspects and thus, also to unify the enforcement level 
within the European Union. Enforcement of data protection provisions by private 
individuals, that is to say competitors, beyond the instruments provided for in the 
regulation, could preclude this unification objective. 
18 It is also not possible to establish beyond doubt that there is a lacuna in terms of 
protection in the GDPR’s enforcement scheme which must be closed by admitting 
the right of competitors to bring legal proceedings under competition law. Under 
Article 8(3) of the Charter of Fundamental Rights of the European Union, 
compliance with the protection of a person’s personal data is to be subject to 
control by an independent authority. Accordingly, the GDPR makes extensive 
provision for the tasks and powers of the supervisory authorities. There may be a 
danger that competition between the supervisory authorities, on the one hand, and 
the civil courts, on the other hand, when enforcing objective data protection law 
would lead to an elimination of the supervisory authorities’ differentiated powers 
and to differences in the enforcement of data protection law within the European 
Union. However, it is to be noted in this connection that, under certain 
circumstances, such competition may exist under Article 80(2) of the GDPR in 
any case. 
19 Support for the assumption that competitors continue to have the power to bring 
legal proceedings under competition law could be found in the retention of a 
desirable additional possibility for enforcement, in accordance with the principle 
of effectiveness (‘effet utile’), to ensure the highest possible level of protection in 
accordance with recital 10 of the GDPR. Enforcement by competitors is a 
particularly effective form of enforcement. Like the bringing of a representative 
action, it makes it possible to prevent a large number of infringements of the 
rights of data subjects and it is thus more effective than the action that a single 
person individually and specifically affected by an infringement of his or her right 
to the protection of his or her personal data may bring against the person 
responsible for that infringement (see Court of Justice, judgment of 28 April 2022, 
Meta Platforms Ireland, C-319/20, EU:C:2022:322, paragraph 75). 
20 The first question referred has not already been clarified by the case-law of the 
Court. No clear answer to this question can be inferred from its judgment of 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-21/23 
 
6  
28 April 2022bin Meta Platforms Ireland. The Court explicitly left open the 
question of a competitor’s standing to bring proceedings (see Court of Justice, 
judgment of 28 April 2022, Meta Platforms Ireland, C-319/20, EU:C:2022:322, 
paragraph 50). 
Consideration of the second question referred 
21 The success of the appeal on a point of law also depends on whether the data that 
the defendant’s customers are required to enter when ordering pharmacy-only but 
not prescription-only medicines on the sales platform (customer’s name, delivery 
address and information required for individualising the pharmacy-only medicine 
ordered) are data concerning health within the meaning of Article 8(1) of the Data 
Protection Directive and of Article 9(1) of the GDPR. 
22 The applicant’s claim for an injunction, based on the danger of repetition and 
addressed at the future, only exists if the defendant’s contested conduct was 
unlawful at the time it took place and is still unlawful at the time of the 
proceedings of the appeal on a point of law. The national provisions on the 
permissibility of the processing of data concerning health, which the applicant 
claims were infringed, transposing Article 8(1), (2)(a) and (3) of the Data 
Protection Directive into German law, have been replaced by Article 9(1) and 
(2)(a) and (h) of the GDPR. 
23 The contested conduct was unlawful at the time it took place if data concerning 
health within the meaning of Article 8(1) of the Data Protection Directive were 
processed during the order process under discussion. Under Article 8(1) of the 
Data Protection Directive, Member States are to prohibit the processing of 
personal data concerning health. There are exceptions to this rule. Of these 
exceptions, if any, explicit consent (Article 8(2)(a) of the Data Protection 
Directive) and the processing of data for the purposes of the provision of care 
(Article 8(3) of the Data Protection Directive) may apply in the present case. The 
requirements for these exceptions have not been fulfilled. It therefore depends on 
whether the data that customers of the defendant are required to enter when 
ordering pharmacy-only but not prescription-only medicines on the sales platform 
are data concerning health within the meaning of Article 8(1) of the Data 
Protection Directive. 
24 The provisions on the processing of the special categories of personal data 
specified above were replaced by Article 9 of the GDPR with effect from 25 May 
2018 (Article 94(1) and Article 99(2) of the GDPR). Article 9(1) of the GDPR 
prohibits the processing of data concerning a natural person’s health. Under 
Article 9(2) of the GDPR this does not apply in cases of consent (Article 9(2)(a) 
of the GDPR) and the provision of health care (Article 9(2)(h) in conjunction with 
Article 3 of the GDPR), which might come into consideration in this case. The 
requirements for these exceptions have not been fulfilled. It therefore depends 
whether the order data under discussion in the present case are data concerning 
health within the meaning of Article 4(15) and Article 9(1) of the GDPR. 
LINDENAPOTHEKE 
 
7 
25 The referring court assumes that the change in the legal situation since the GDPR 
has entered into force is not associated with any change in the content-related 
requirements applicable to the special category of health-related personal data 
under EU law. The Court also based its interpretation of the special categories of 
personal data on the assumption that the Data Protection Directive and the GDPR 
have unified standards (see Court of Justice, judgment of 1 August 2022, 
Vyriausioji tarnybínes etikos komisija, C-184/20, EU:C:2022:601, paragraphs 117 
to 128). The concept of data concerning health in the two instruments may 
therefore be deemed to be identical, enabling a uniform clarification to be made of 
the two terms in the second question referred. 
26 A clear answer cannot be given to the second question referred. 
27 Under Article 4(15) of the GDPR, ‘data concerning health’ means personal data 
related to the physical or mental health of a natural person, including the provision 
of health care services, which reveal information about his or her health status. 
Under Article 4(1) of the GDPR, ‘personal data’ means any information relating 
to an identified or identifiable natural person; an identifiable natural person is one 
who can be identified, directly or indirectly, in particular by reference to an 
identifier such as a name or location data. 
28 The present case has the special feature that the action relates unreservedly to 
sales of pharmacy-only medicines via the online sales platform Amazon. 
Customers of the defendant can also order pharmacy-only, non-prescription 
medicines there. Non-prescription medicines do not require a doctor’s prescription 
indicating the person to whom the medicine has been prescribed and thus who is 
to take it. That means that it cannot be ruled out that the buyer of non-prescription 
medicines whose order data (customer’s name, delivery address and the 
information required for individualising the pharmacy-only medicine ordered) are 
processed by the defendant himself or by Amazon on his behalf is not the person 
who takes the medicine ordered, but that the buyer purchases the medicines for 
third parties and passes them on to them. 
29 It is questionable whether information may be deemed to be data concerning 
health when it cannot be assumed with any certainty, but only with a certain 
degree of probability, that the natural person identified or identifiable by their 
name and delivery address will also take the medicine ordered and thus, that 
information about their state of health may be inferred from the order data as a 
whole. 
30 No clear indications for answering this question arise from the wording of 
Article 4(15) and Article 9(1) of the GDPR or from recital 35 of the GDPR. 
31 However, the Court has ruled that a wide interpretation of the term ‘special 
categories of personal data’ within the meaning of Article 9 of the GDPR is 
confirmed by the objective of the Data Protection Directive and the GDPR, which 
is to ensure a high level of protection of the fundamental rights and freedoms of 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-21/23 
 
8  
natural persons, in particular of their private life, with respect to the processing of 
personal data concerning them (Court of Justice, judgment of 1 August 2022, 
Vyriausioji tarnybínes etikos komisija, C-184/20, EU:C:2022:601, paragraph 125). 
This could militate in favour of information being deemed to be data concerning 
health even when it may not be assumed with certainty, but only with a certain 
degree of probability, that the natural person identified or identifiable by their 
name and delivery address will actually take the medicine ordered.