Continuing our coverage of the Federal Court of Justice (BGH) press release (No. 059/2025) dated March 27, 2025, we take a look at the facts behind BGH rulings I ZR 222/19 and I ZR 223/19 regarding the standing of competitors to sue.

In both proceedings, the BGH was presented with similar facts: A pharmacist sold their product range, which included pharmacy-only medicines, via the Amazon Marketplace online sales platform. Another pharmacist viewed this as a violation of the Act Against Unfair Competition (UWG), arguing that this distribution involved the processing of health data within the meaning of Article 9 (1) of the EU General Data Protection Regulation (GDPR). Customers had not explicitly consented to this processing. The argument was that the GDPR provisions should be regarded as market conduct rules within the meaning of the UWG. The BGH initially stayed both proceedings and referred the following questions to the Court of Justice of the European Union (CJEU):

‍

1. Does a competitor have standing to sue, or are the provisions contained in the GDPR for the enforcement of its requirements (which do not include standing for competitors) exhaustive?

2. Is the data that customers must enter when ordering pharmacy-only, but not prescription-only, medicines online considered health data within the meaning of Article 9 (1) GDPR?

The CJEU ruled on this on October 4, 2024, in case C-21/23:

1. The provisions of the GDPR do not preclude an injunctive claim by a competitor for engaging in an unfair commercial practice under Sections 8 (1), (3) no. 1, and 3 of the UWG. EU member states are permitted to expand national legal enforcement options beyond the regulations contained in the GDPR.

In this regard, the CJEU clarified that when interpreting a provision of Union law, one must consider not only its wording but also its context and the objectives of the regulation.

The CJEU took the opportunity—as it had in one of its Meta decisions (CJEU judgment of April 28, 2022, C-319/20)—to comment on competition between companies in the digital economy. It emphasized that access to personal data and the ability to process it have become a significant parameter of competition. To account for actual economic developments and maintain fair competition, it is therefore possible to rely on data protection regulations when enforcing competition law. This is particularly true because a competitor's ability to sue for an injunction against an alleged data protection violation actually strengthens the practical effectiveness of data protection requirements, thereby improving the high level of protection intended by the GDPR. In this respect, the competitor's right to sue exists alongside the GDPR remedies available to the data subjects.

2. If data regarding the purchase of medicines allows for conclusions to be drawn about a person's state of health, it is to be classified as health data within the meaning of the GDPR.

The CJEU explained that the data a customer enters when ordering pharmacy-only medicines via an online platform can be used to infer the health status of the person concerned through logical combination or deduction. In this respect, an order enables a connection between a medicine, its therapeutic indications and applications, and a natural person who is identified or identifiable through details such as their name or delivery address.

To ensure a high level of protection for health data, it is irrelevant whether the data processing is specifically aimed at processing health data or whether the information processed is accurate. Processing of health data also occurs when a user of an online platform transmits personal data while ordering pharmacy-only, but non-prescription, medicines. It does not matter whether the user discloses whether the order is for themselves or for another person. The CJEU added that if such medicines are ordered for persons other than the customer, it cannot be ruled out that a link to that person could be established—for example, if the medicines are not delivered to the ordering customer's home address, but to the address of a third party.

Implementing the CJEU's case law, the BGH ruled that Article 9 (1) GDPR is a market conduct rule within the meaning of Section 3a UWG, meaning that a violation of this provision can be pursued by a competitor through legal action under Section 8 (3) no. 1 UWG.

Beyond confirming the standing of competitors to sue, the classification of "order data" as health data is likely to have significant practical implications. If all personal data collected in close connection with health data now falls under the scope of Article 9 GDPR, many processing operations will need to be reassessed and adjusted. But is this truly what the courts intended? This could affect, for example, video recordings in the entrance areas of medical practices, pharmacies, or hospital driveways. Or might these decisions be interpreted more narrowly in the end? Future practice by authorities and courts will tell.

‍

Anja Hillig, Salary Partner