European Union: Issued ruling in lawsuit challenging online pharmacies for alleged GDPR violations on customer data consent (ND v DR) (C-21/23)

On 4 October 2024, the Court of Justice of the European Union (CJEU) issued a ruling pertaining to the General Data Protection Regulation (GDPR) in a dispute between two pharmacists after the owner of Lindenapotheke was sued by a competitor for marketing medicinal products on Amazon without ensuring prior customer consent. The German Federal Court of Justice sought clarification on whether national legislation permitting competitors to initiate legal proceedings for GDPR violations as unfair commercial practices aligns with the GDPR. It also sought clarification on whether customer information provided during online purchases of pharmacy-only medicinal products is classified as health data under the GDPR, even when no prescription is required. The Court ruled that the GDPR allows national legislation permitting competitors to sue for violations based on unfair commercial practices, to strengthen data subject rights. Additionally, the Court determined that customer information collected during online orders for pharmacy-only medicinal products, such as names and delivery addresses, qualifies as health data under the GDPR, regardless of whether a prescription is required. The Court highlighted that since such data can indicate an individual's health status by linking them to specific medicinal products, sellers must accurately inform customers about the data processing characteristics and purposes and obtain explicit consent for such processing.