While unfair competition law allows companies to sue their competitors for certain behaviours which constitute unfair commercial practices, data protection law essentially gives data subjects the right to take action against unlawful processing of their personal data. But what if unlawful data processing is an unfair commercial practice? Can a competitor be the knight in shining armour for data subjects and sue the controller on competition law basis? The fresh decision of the CJEU analysed in this article answers the question.
ILF’s Hungarian member, Smartlegal Schmidt&Partners summarizes this issue in the article.
1. Facts
A company under the tradename Lindenapotheke markets pharmacy-only medical products on the Amazon-Marketplace. When ordering the products, customers of Lindenapotheke must enter certain data such as their name, delivery address and details required for individualising the products.
Based on the German unfair competition law, which allows a person to seek injunction against his competitor if the latter infringes laws which regulate market behaviour, a competitor sued Lindenapotheke and requested the court to ban him from marketing pharmacy-only products on Amazon. According to the competitor the practice that Lindenapotheke does not request the prior consent of the customers to the processing of their health data constitutes unfair practice.
The first and second instance courts agreed with the competitor and ordered Lindenapotheke to cease marketing pharmacy-only medical products on the Amazon. Lindenapotheke lodged an appeal on the point of law with the German Federal Court of Justice. This court found that certain questions related the GDPR shall be answered and referred the case to the Court of Justice of the European Union.
2. Questions to the CJEU
The Luxembourg Court needed to answer two questions. First, the CJEU should clarify whether the GDPR allows Member States to grant competitors the power to bring proceedings against another competitor infringing the GDPR under the prohibition of unfair commercial practices.
The second question was if the data of an online pharmacist’s customers which they provide in connection with the order of pharmacy-only (but not prescription-only) products constitute data concerning health in the sense of the GDPR?
3. Can a competitor sue because of GDPR infringements?
To answer this question, the CJEU first analysed the system of legal remedies enabling the protection of data subject’s rights available under the GDPR.
The Court recalled that the data subject has the right to lodge a complaint with a supervisory authority[i], further the GDPR guarantees data subjects the right to effective judicial remedy[ii]. These rights cannot only be exercised directly by the data subjects but by a non-profit body, organisation or association mandated by the data subject or a body, organisation or association appointed by a Member State[iii].
None of above provisions of the GDPR rule out the possibility for a competitor to bring action on the basis of unfair competition laws, but on the contrary, all these rights are provided ‘without prejudice’ to any other legal remedy.
Further, the violation of the GDPR might also affect third parties, which is illustrated by the fact that the GDPR provides for a right to compensation for any person who has suffered a damage as a result of an infringement of the GDPR[iv].
The possibility for competitors to bring action against the infringer of the GDPR is not only supported by the wording of the GDPR but it stems also from its objective which is to ensure a consistent and high level of protection of data subjects. The right for competitors to take a civil action for infringement of the GDPR in order to prevent unfair commercial practices enhance the practical effectiveness of the GDPR and improve the protection of data subjects.
4. Does Lindenapotheke process data concerning health?
The Luxembourg Court emphasized its previous practice[v] according to which ‘data concerning health’ just as other special categories of personal data in the sense of GDPR must be interpreted broadly. In order for a data to be classified as data concerning health, it is sufficient that they are capable of revealing information about the health status of the data subject by means of an intellectual operation such as collation or deduction.
In the present case, data entered by the customer of Lindenapotheke when ordering pharmacy-only products are capable of revealing information on the health status of the customer if a link can be established between the medicinal products, its therapeutic indications or uses and the customer identified or identifiable by factors such as his name or delivery address.
The CJEU added that the classification of the data provided by the customer as ‘data concerning health’ should not depend on whether or not the sale of the medicinal products requires a prescription or not. The contrary interpretation would not be consistent with the objective of the GDPR which is to ensure a high level of protection to data subjects.
5. Summary
As shown above, when interpreting the provisions of the GDPR the CJEU always has the effective protection of data subjects in mind.
This objective is served on the one hand, by ensuring the widest possible remedies such as the fact that the Court has not excluded the possibility for persons other than the data subject to bring civil actions against the controller for GDPR-breaches on a competition-law basis. This means that controllers may need to be wary not only of data subjects but also other market players such as their competitors.
On the other hand, data subjects are also effectively protected by the CJEU’s broad interpretation of the concept of data concerning health, based on which data provided by the customer when purchasing non-prescription medicinal products may be considered as data concerning health.
The article was written by dr. Anita Vereb.
In this article we analysed the judgement C-21/23 of the CJEU.
SMARTLEGAL is a team of agile business & litigation lawyers in Budapest, Hungary, helping international corporate clients and individual entrepreneurs doing business in Hungary. For more information please visit our website at smartlegal.hu