“Legal disputes around the right to sue of consumer associations and competitors against potential breaches of EU GDPR have been going on for years,” said Julia Traumann of Pinsent Masons.
“While the CJEU affirmed last year that consumer associations can bring civil claims against companies for breaches of the EU GDPR, a similar decision with regard to competitors’ right to take civil action is still pending. The latest decision of the German Federal Court of Justice does not clarify the issue but brings a further stay of the proceedings and another round at the CJEU,” she said.
The matters Traumann refers to centre on civil actions taken by pharmacists against other pharmacists, who sell medicines on internet platforms like Amazon. The claimants in both cases argue that their competing pharmacists, the defendants, are in breach of the EU GDPR by processing health data, as it is defined by Article 9(1) of the EU GDPR, without obtaining the necessary consent from their customers.
The alleged claims are based on German unfair competition law, which contains a provision allowing competitors to raise claims in case of a violation of a statutory provision; provided that the relevant provision is at least also intended to regulate market behaviour, and if the breach of law is “suited to appreciably harm” the interests of competitors or other market participants.
The German Federal Court of Justice has stayed proceedings, and asked the CJEU for a preliminary hearing on whether the relevant provisions of the EU GDPR preclude German domestic rules that grant competitors the power to take legal action in civil courts for data protection infringements that represent unfair competition practices. The German judges have also asked the CJEU whether the data entered by customers of pharmacists when ordering pharmacy-only medicinal products online via an internet sales platform is classified as "health data" within the meaning of Article 9(1) GDPR and “data relating to health” within the meaning of Article 8(1) of the Data Protection Directive.
Marc L. Holtorf said: “Regardless of the fact that the current cases are still going through an extra round at the CJEU, it is clear that retailers will have to take data protection even more seriously in the future due to a potentially increased risk of being sued. While data protection authorities often suffer from a lack of staff and therefore are behind with the enforcement of the GDPR, consumer associations and possibly also competitors have more power and resources and a differing motivation.”
Traumann added: “Already only due to the - not yet confirmed - possibility of legal action being brought by competitors in the event of alleged violations of the GDPR, companies in the relevant sectors must be prepared for legal warnings and also civil court proceedings if their business practices do not comply with the regulatory requirements.”