We are continuing our contribution to the press release (No. 059/2025) of the Federal Court of Justice (BGH) dated March 27, 2025 and take a look at the facts behind the BGH judgments I ZR 222/19 and I ZR 223/19 concerning the right of action by competitors.
Similar facts were presented to the Federal Court of Justice in both proceedings: A pharmacist sold his product range, which also includes pharmacy-only drugs, via the Internet sales platform Amazon Marketplace. Another pharmacist saw this as a violation of the Unfair Competition Act (UWG) because this distribution involves processing of health data within the meaning of Art. 9 (1) EU General Data Protection Regulation (GDPR). Customers would not have expressly consented to this processing. The GDPR provisions should be regarded as market conduct rules within the meaning of the UWG. The Federal Court of Justice had initially stayed both proceedings and asked the European Court of Justice (ECJ) the following questions:
1. Does a competitor have legal standing or are the rules contained in the GDPR to enforce its provisions (which do not include the right of action from competitors) final?
2. Is the data that customers would have to enter when ordering pharmacy-only but not prescription drugs online health data within the meaning of Art. 9 (1) GDPR?
The ECJ ruled on this on 04.10.2024 in Case C‑21/23:
1. The regulations of the GDPR apply to Injunctive relief from a competitor not due to the conduct of an unfair act in accordance with Sections 8 (1), (3) No. 1, 3 UWG. EU member states may expand national law enforcement options, even beyond the regulations contained in the GDPR.
In this regard, the ECJ clarified that when interpreting a provision of EU law, account must be taken not only of its wording but also of its context and regulatory objectives.
The ECJ took the opportunity — as in one of its meta-decisions (ECJ ruling of 28 April 2022, C‑319/20) — to comment on competition between companies in the digital economy. He stressed that access to and the ability to process personal data have become an important competitive parameter. In order to take account of actual economic development and to maintain fair competition, it is therefore possible to also rely on data protection rules when enforcing competition law. In particular because the ability of a competitor to sue for failure to commit an allegedly committed data protection violation actually strengthens the practical effectiveness of the data protection requirements and thus improves the high level of protection sought by the GDPR. In this respect, the competitors' right of action goes side by side with the GDPR appeals of those affected.
2. When from the data on the purchase of medicinal products Conclusions can be drawn about a person's health status, they are to be classified as health data within the meaning of the GDPR.
In this regard, the ECJ stated that the health status of the person concerned could be inferred from the data entered by a customer when ordering pharmacy-only medicines via an online platform. In this respect, an order enables a connection between a medicinal product, its therapeutic indications and uses and an identified natural person or who can be identified by information such as the name or delivery address.
In order to ensure a high level of protection for health data, it is irrelevant whether the data processing is aimed at processing health data or whether the processed information is correct. Health data is also processed if a user provides personal data to an online platform when ordering pharmacy-only but non-prescription drugs. It is not important that he disclose whether the order was made for himself or someone else. In addition, the ECJ stated that — when such medicinal products are ordered for people other than customers — it cannot be ruled out that a connection to this person could be established. This applies, for example, if the medicinal products are not delivered to the place of residence of the ordering customer, but to the place of residence of a third party.
In implementation of the ECJ case law, the Federal Court of Justice ruled that Article 9 (1) GDPR was a market conduct regulation within the meaning of Section 3a UWG, so that the infringement of this provision could be prosecuted by a competitor in accordance with Section 8 (3) No. 1 UWG.
In addition to the affirmation of competitors' right of action, the classification of “order data” as health data in particular is likely to have an impact on practice. Because if all personal data collected in close connection with health data now falls within the scope of protection under Article 9 GDPR, many processing processes would have to be reassessed and adjusted. But is this actually intended by case law? Video recordings in the entrance areas of medical practices, pharmacies or hospital entrances would be affected, for example. Or can the decisions be interpreted more narrowly in the end? — The future practice of authorities and courts will show.
