Online medicine sales and the processing of purchase data: The Court of Justice of the European Union rules

Data related to purchasing non-prescription medicine sold online by an authorized pharmacy should not be considered health-related data under the GDPR. Therefore, such data can be processed without first obtaining the consent of the data subject. It follows that a pharmacy selling its medicines online without first obtaining the consent of purchasers is not participating in unfair competition against another pharmacy. These are the conclusions rendered by Maciej Szpunar, advocate general of the Court of Justice of the European Union (CJEU) in Case C-21/23, published on April 25, 2024.

The facts and the matter submitted to the court

The request for a preliminary ruling from the CJEU stems from an action for injunction brought at the national level by a German pharmacy (DR) seeking to have a competing pharmacy (ND) cease marketing non-prescription medicines online via Amazon.

According to the claimant, ND allegedly violated Article 9 of the GDPR by processing the data (names, delivery addresses, and information about products ordered) of customers who ordered medicines online without first obtaining their consent. If this were found to be true, DR would be justified in taking action to halt such conduct, because under German law, the violation of a legal provision, including a privacy regulation, may result in an act of unfair competition by one company to the detriment of another.

The German court of first instance (District Court of Dessau-Roßlau) upheld DR’s claim, finding that the marketing of medicines on Amazon amounted to health-related data processing to which ND’s customers did not expressly consent—a scenario that would support the plaintiff’s injunction action under German competition law.

In the subsequent second-instance proceeding, the Naumburg Higher Regional Court rejected the appeal brought by ND. ND appealed to the Bundesgerichtshof, which stayed the proceedings and submitted to the CJEU the following request for a preliminary ruling: “Are the data—customer name, delivery address, and information necessary for the identification of the ordered medicine whose sale is reserved for pharmacies—provided by customers on the pharmacy’s online sales platform while ordering medicine whose sale is reserved to pharmacies, but which are nonetheless not subject to prescription, health-related data under the meaning of Article 9(1) of the GDPR and Article 8(1) of Directive 95/46?”

“Data concerning health”

According to Article 4(15) of the GDPR and Recital No. 35, “data concerning health” are personal data relating to the physical or mental health of a natural person that reveal information relating to their state of health, including information concerning a disease, disability, risk of disease, medical history, clinical treatments, or physiological or biomedical state, regardless of the source. In other words, the decisive element in determining whether data are “concerning health” is whether or not it is possible to draw conclusions about a data subject’s health status from such information. This approach was confirmed by the European Data Protection Board.^[1]

Article 9 of the GDPR generally prohibits processing such data unless one of the conditions listed in the second paragraph, including the express consent of the data subject, is met. Generally, the purchase of medicines, which are health products par excellence, is apt to disclose information related to the health of the purchaser; however, in the case brought before the court, the advocate general found the link between the purchase of medicines and the purchasers’ states of health too weak to fall under Article 9 of the GDPR.

Advocate general’s conclusions

According to Szpunar, in the case of purchase of non-prescription medicine through an online platform, it is not possible to draw firm conclusions about the purchaser’s health status from the data shared at the time of purchase, since:

• non-prescription medicines are, by definition, intended for treatment of everyday ailments that are not symptomatic of a particular disease or health condition (think of a general pain reliever like acetaminophen that is used to relieve all kinds of aches and pains and fever);
• such medicines are often purchased as a preventive measure and kept on hand so they are available when needed, or to be taken outside the home when traveling or going out for the day;
• such a purchase could be made by one person for another (e.g., a child for a parent), and since these products do not require a doctor’s prescription, the actual user cannot be determined from the purchase data;
• finally, the data provided to the seller/platform during an online purchase do not always allow for the purchaser to be specifically identified, whether or not they are the actual user (especially if the delivery is made to a pickup point, a delivery method offered by Amazon).

In light of the above, pharmacy customer data transmitted when medicines that can only be sold by pharmacies but do not require a prescription are sold on an online platform do not qualify as “data concerning health” under Articles 4(15) and 9 of the GDPR, since only hypothetical and possibly inaccurate conclusions about the health status of the person placing the online order can be drawn from them.

Conversely, data related to the sale (where permitted by national law) or online ordering of prescription medicine should be considered “data concerning health” and as such is subject to further constraints and restrictions.

A paradigm shift?

In this case, the advocate general has issued a restrictive interpretation of the notion of “data concerning health.” Until now, the CJEU has upheld a broad interpretation designed to offer maximal protection for data subjects—necessary given the sensitive nature of such information and the way it affects privacy and the fundamental rights of the individual. Indeed, the CJEU has interpreted the notion of “special categories of personal data” to refer not only to inherently sensitive data, but also to data that “indirectly reveal, at the end of an intellectual operation of deduction or comparison, information of that nature.”^[2]

The possible implications

Similarly, as far as Italy is concerned, consider a recent order of the Court of Cassation specifying that “health data” is any information that can be linked to a person’s status and from which the need for medical assistance is inferred, regardless of specificity.^[3] Therefore, it will be interesting to see whether the advocate general’s position will be upheld by the CJEU decision in the coming weeks, as it could pave the way for more rigorous assessment of whether information actually reveals a person’s health status and thus ought to be classified as health data.

[1] Guideline 03/2020 on the processing of health-related data for scientific research purposes in the context of the Covid 19 emergency.

[2] Judgment of August 1, 2022, Vyriausioji tarnybinės etikos komisija C184/20‑, EU:C:2022:601, paragraph 123.

[3] No. 28417 of October 11, 2023.