62023CJ0021_RES
Case C‑21/23
ND
v
DR
(Request for a preliminary ruling from the Bundesgerichtshof)
Judgment of the Court (Grand Chamber) of 4 October 2024
(Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Chapter VIII – Remedies – Medicinal products marketed by a pharmacist on an online platform – Action brought before the national civil courts by a competitor of that pharmacist on the basis of the prohibition of unfair commercial practices for infringement by the pharmacist of the obligations laid down by that regulation – Standing to bring proceedings – Article 4(15) and Article 9(1) and (2) – Directive 95/46/EC – Article 8(1) and (2) – Concept of ‘data concerning health’ – Conditions for the processing of those data)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Remedies – Not exhaustive – National legislation allowing competitors of the person allegedly responsible for an infringement of the obligations laid down in the regulation to bring proceedings before the civil courts on the basis of the prohibition of unfair commercial practices – Whether permissible
(European Parliament and Council Regulation 2016/679, Arts 77 to 80)
(see paragraphs 53-57, 60, 62-73, operative part 1)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Concept of ‘data concerning health’ – Information concerning the customers of an operator of a pharmacy marketing medicinal products on an online platform, provided when ordering those products – Information on the name of those customers, the delivery address and that necessary for individualising the medicinal products – Included – Sale of medicinal products not requiring a prescription – Irrelevant
(European Parliament and Council Regulation 2016/679, Arts 4(1) and (15) and 9(1); European Parliament and Council Directive 95/46, Art. 8(1))
(see paragraphs 84, 88-91, operative part 2)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Processing of special categories of personal data – Prohibition – Derogations
(European Parliament and Council Regulation 2016/679, recital 53, Art. 9(1) and (2); European Parliament and Council Directive 95/46, Art. 8(1) and (2))
(see paragraphs 86, 87, 92, 93)
Résumé
Hearing a request for a preliminary ruling from the Bundesgerichtshof (Federal Court of Justice, Germany), the Grand Chamber of the Court of Justice rules on the nature and scope of the system of remedies with regard to data protection (
1
) and on the concept of ‘data concerning health’. (
2
)
ND and DR, two natural persons, each operates a pharmacy in Germany. Since 2017, ND has been marketing pharmacy-only medicinal products on the online platform ‘Amazon-Marketplace’. When they order online, ND’s customers must enter information, such as their name, the delivery address and details required for individualising those medicinal products.
Relying on German law on unfair competition, (
3
) DR brought an application for injunctive relief against ND before the national civil courts. DR claimed that the marketing of the medicinal products by ND was unfair, on account of the failure to comply with the legal requirement to obtain the customer’s prior consent to the processing of his or her data concerning health.
After the lower courts upheld that action, ND brought an appeal on a point of law before the referring court, which, in turn, considered it necessary to make a reference to the Court for a preliminary ruling.
In its judgment, the Court concludes that the system of legal remedies established by the GDPR is non-exhaustive, recognising that that regulation does not preclude Member States from providing, in national law, for the possibility for competitors of the person allegedly responsible for an infringement of the substantive provisions of that regulation to challenge that infringement before the courts as an unfair commercial practice. In addition, it provides clarification on the scope of the concept of ‘data concerning health’.
Findings of the Court
In the first place, the Court notes that, although Chapter VIII of the GDPR does not specifically provide for an opening clause which would expressly allow Member States to make such a remedy available to competitors, it nevertheless follows from the wording and context of the provisions of Chapter VIII that the EU legislature did not intend to rule out that possibility. That interpretation is confirmed by the objectives pursued by the GDPR.
On the one hand, an application for injunctive relief brought by a competitor against an undertaking on the basis of the prohibition of unfair commercial practices, on account of the alleged infringement of the substantive provisions of the GDPR in no way undermines the system of remedies provided for in that regulation or the objective of ensuring a consistent level of protection for natural persons throughout the European Union and of preventing divergences hampering the free movement of personal data within the internal market.
In that regard, the Court states that it is true that such an application may be based, albeit incidentally, on an infringement of the same provisions of the GDPR as those on which a complaint or action brought by the data subjects or by a body, organisation or association representing those data subjects may be based. (
4
) However, unlike those remedies provided for by the GDPR, an application for injunctive relief brought by a competitor does not, as such, pursue an objective of protection of the fundamental rights and freedoms of data subjects with regard to the processing of their personal data, but seeks to ensure fair competition, in the interests, inter alia, of that competitor.
In addition, the possibility for a competitor to bring such an action before the civil courts on the basis of the prohibition of unfair commercial practices is in addition to the remedies established by the GDPR, which remain in full and can still be pursued by data subjects and, where appropriate, by associations representing data subjects. In particular, the coexistence of remedies under data protection law and competition law does not create a risk for the uniform application of that regulation.
Moreover, the fact that the substantive provisions of the GDPR may be relied on more widely, by persons other than just data subjects and bodies, organisations and associations, does not undermine the attainment of the objective of ensuring a consistent level of protection of those persons throughout the European Union and of preventing divergences hampering the free movement of personal data within the internal market. Even if the Member States did not provide for such a possibility, this would not result in a fragmentation of the implementation of data protection in the European Union, as the substantive provisions of the GDPR are binding in the same way on all data controllers and compliance with those provisions is ensured by the remedies provided for in that regulation.
On the other hand, as regards the objective of ensuring effective protection of data subjects with regard to the processing of their personal data and the effectiveness of the substantive provisions of the GDPR, the Court notes that, although an application for injunctive relief brought by a competitor of the person allegedly responsible for an infringement of the laws protecting personal data pursues not that objective but that of ensuring fair competition, the fact remains that it undoubtedly contributes to compliance with those provisions and, therefore, to strengthening the rights of data subjects and ensuring that they enjoy a high level of protection. Moreover, such an application for injunctive relief brought by a competitor may prove, like that brought by a consumer protection association, to be particularly effective in ensuring such protection, in so far as it is capable of preventing a large number of infringements of the rights of data subjects by the processing of their personal data. (
5
)
The Court finds that the provisions of the GDPR must be interpreted as not precluding national legislation which, alongside the powers of intervention of the supervisory authorities responsible for monitoring and enforcing that regulation and the remedies available to data subjects, confers on competitors of the person allegedly responsible for an infringement of the laws protecting personal data standing to bring proceedings against that person, by means of an action before the civil courts, for infringements of that regulation and on the basis of the prohibition of unfair commercial practices.
In the second place, as regards the concept of ‘data concerning health’, the Court finds that that concept covers data which a customer enters in an online platform when ordering pharmacy-only medicinal products. Those data are capable of revealing, by means of an intellectual operation involving collation or deduction, information on the health status of the data subject, (
6
) in so far as that order entails establishing a link between a medicinal product, its therapeutic indications or uses, and a natural person identified or identifiable by factors such as that person’s name or the delivery address.
Furthermore, the Court holds that it is irrelevant in that regard that the sale of the medicinal products ordered does not require a prescription and that they might therefore be intended not for the customer making the order, but for third parties. Thus, where a user of an online platform communicates personal data when ordering pharmacy-only medicinal products the sale of which does not require a prescription, the processing of those data by the operator of a pharmacy which sells those medicinal products on that online platform must be regarded as processing of data concerning health, (
7
) given that the processing of those data is capable of revealing information on the health status of a natural person, irrespective of whether that information concerns that user or any other person for whom the user places the order. (
8
)
An interpretation which would result in a distinction being made according to the type of medicinal product concerned and to whether or not the sale thereof requires a prescription would not be consistent with the objective of ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their private life, with respect to the processing of personal data concerning them. Such an interpretation would, moreover, run counter to the purpose of Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR, namely to ensure enhanced protection as regards processing which, because of the particular sensitivity of the data processed, is liable to constitute a particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data. (
9
) Consequently, the information which customers enter when ordering online pharmacy-only medicinal products the sale of which is does not require a prescription constitutes data concerning health, even where it is only with a certain degree of probability, and not with absolute certainty, that those medicinal products are intended for those customers.
The Court adds that it is not inconceivable that, even if such medicinal products are intended for persons other than the customers, it may be possible to identify those persons and draw conclusions about their health status. That could be the case, for example, where the medicinal products in question are delivered not to the home of the customer who ordered them but to the home of another person, or where, irrespective of the delivery address, the customer referred, in the order or in any communication relating to the order, to another identifiable person, such as a family member.
Lastly, the Court notes that the fact that the information in question constitutes data concerning health does not preclude it from being processed, in particular in the context of the management of healthcare services and systems, if one of the conditions set out in that regard is met. (
10
) First, this may in particular be the case where the data subject gives explicit consent to one or more processing operations involving those personal data, the specific characteristics and purposes of which have been presented to him or her in an accurate, comprehensive and easily understandable manner. Second, such processing may be permissible where processing is necessary for the purposes of the provision of healthcare on the basis of EU or Member State law or pursuant to a contract with a health professional.
(
1
)	Chapter VIII of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’).
(
2
)	Referred to, respectively, in Article 8(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) and in Article 9(1) of the GDPR.
(
3
)	Gesetz gegen den unlauteren Wettbewerb (Law against unfair competition) of 3 July 2004 (BGB1. 2004 I, p. 1414), in the version applicable to the main proceedings.
(
4
)	Articles 77 to 80 of the GDPR.
(
5
)	See, to that effect, judgment of 28 April 2022, Meta Platforms Ireland (C‑319/20, EU:C:2022:322, paragraphs 74 and 75).
(
6
)	Article 4(1) of the GDPR.
(
7
)	Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR.
(
8
)	See, to that effect, judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network) (C‑252/21, EU:C:2023:537, paragraph 73).
(
9
)	See judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija (C‑184/20, EU:C:2022:601, paragraph 126 and the case-law cited).
(
10
)	Conditions set out in Article 8(2) of Directive 95/46 and Article 9(2) of the GDPR.