{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-21-23-62023cj0021","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-21-23-62023cj0021)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-15","fingerprint":"ewai:eu:8d311e","proof":"sha256:20afa79ffdfd24cebea2506bd6f64c2beeee376b3109e48708e8f167842ad342","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-21-23-62023cj0021","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62023CJ0021","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Grand Chamber)","paragraphs":[]},{"title":"4 October 2024 (\n *1\n ) (\n i\n )","paragraphs":["para_4","para_5","para_6"]},{"title":"ND","paragraphs":["para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_28"]},{"title":"2","paragraphs":["para_30"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"3","paragraphs":["para_34","para_35"]},{"title":"2.   Paragraph 1 shall not apply where:","paragraphs":[]},{"title":"(a)","paragraphs":["para_38","para_39"]},{"title":"4","paragraphs":[]},{"title":"Recitals 9 to 11, 13, 35, 51, 53, 141 and 142 of the GDPR are worded as follows:","paragraphs":["para_42","para_43"]},{"title":"(10)","paragraphs":["para_45"]},{"title":"(11)","paragraphs":["para_47","para_48"]},{"title":"(13)","paragraphs":["para_50","para_51"]},{"title":"(35)","paragraphs":["para_53","para_54"]},{"title":"(51)","paragraphs":["para_56","para_57"]},{"title":"(53)","paragraphs":["para_59","para_60"]},{"title":"(141)","paragraphs":["para_62"]},{"title":"(142)","paragraphs":["para_64"]},{"title":"5","paragraphs":[]},{"title":"Article 1 of that regulation, entitled ‘Subject matter and objectives’, provides:","paragraphs":["para_67","para_68","para_69"]},{"title":"6","paragraphs":[]},{"title":"Article 4 of that regulation provides:","paragraphs":["para_72"]},{"title":"(1)","paragraphs":["para_74"]},{"title":"(2)","paragraphs":["para_76","para_77"]},{"title":"(7)","paragraphs":["para_79","para_80"]},{"title":"(15)","paragraphs":["para_82","para_83"]},{"title":"(21)","paragraphs":["para_85","para_86"]},{"title":"7","paragraphs":["para_88"]},{"title":"8","paragraphs":["para_90"]},{"title":"9","paragraphs":["para_92","para_93"]},{"title":"2.   Paragraph 1 shall not apply if one of the following applies:","paragraphs":[]},{"title":"(a)","paragraphs":["para_96","para_97"]},{"title":"(h)","paragraphs":["para_99","para_100"]},{"title":"10","paragraphs":[]},{"title":"Article 51 of the GDPR, entitled ‘Supervisory authority’, provides, in paragraph 1:","paragraphs":["para_103"]},{"title":"11","paragraphs":["para_105"]},{"title":"12","paragraphs":["para_107","para_108"]},{"title":"13","paragraphs":["para_110","para_111"]},{"title":"14","paragraphs":["para_113","para_114"]},{"title":"15","paragraphs":[]},{"title":"Article 80 of the GDPR, entitled ‘Representation of data subjects’, is worded as follows:","paragraphs":["para_117","para_118"]},{"title":"16","paragraphs":["para_120","para_121"]},{"title":"17","paragraphs":["para_123","para_124"]},{"title":"18","paragraphs":[]},{"title":"Article 84 of that regulation, entitled ‘Penalties’, provides, in paragraph 1:","paragraphs":["para_127"]},{"title":"19","paragraphs":[]},{"title":"Article 94 of the GDPR stipulates, in paragraph 1:","paragraphs":["para_130"]},{"title":"20","paragraphs":[]},{"title":"Article 99 of the regulation provides:","paragraphs":["para_133"]},{"title":"2.   It shall apply from 25 May 2018.’","paragraphs":[]},{"title":"German law","paragraphs":[]},{"title":"Law against unfair competition","paragraphs":[]},{"title":"21","paragraphs":["para_138","para_139"]},{"title":"22","paragraphs":[]},{"title":"Paragraph 3a of the UWG, entitled ‘Infringement of the law’, is worded as follows:","paragraphs":["para_142"]},{"title":"23","paragraphs":[]},{"title":"Paragraph 8 of that law, entitled ‘Cease and desist and prohibitory injunction’, states:","paragraphs":["para_145","para_146"]},{"title":"(3)   The injunctive relief referred to in subparagraph 1 may be claimed by:","paragraphs":["para_148","para_149","para_150"]},{"title":"Law on the marketing of medicinal products","paragraphs":[]},{"title":"24","paragraphs":["para_153"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"25","paragraphs":["para_156"]},{"title":"26","paragraphs":["para_158"]},{"title":"27","paragraphs":["para_160"]},{"title":"28","paragraphs":["para_162"]},{"title":"29","paragraphs":["para_164"]},{"title":"30","paragraphs":["para_166"]},{"title":"31","paragraphs":["para_168"]},{"title":"32","paragraphs":["para_170"]},{"title":"33","paragraphs":["para_172"]},{"title":"34","paragraphs":["para_174"]},{"title":"35","paragraphs":["para_176"]},{"title":"36","paragraphs":["para_178"]},{"title":"37","paragraphs":["para_180"]},{"title":"38","paragraphs":["para_182"]},{"title":"39","paragraphs":["para_184"]},{"title":"40","paragraphs":["para_186"]},{"title":"41","paragraphs":["para_188"]},{"title":"42","paragraphs":["para_190"]},{"title":"43","paragraphs":["para_192"]},{"title":"44","paragraphs":["para_194"]},{"title":"45","paragraphs":["para_196","para_197","para_198"]},{"title":"(2)","paragraphs":["para_200"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"The first question","paragraphs":[]},{"title":"46","paragraphs":["para_204"]},{"title":"47","paragraphs":["para_206"]},{"title":"48","paragraphs":["para_208"]},{"title":"49","paragraphs":["para_210"]},{"title":"50","paragraphs":["para_212"]},{"title":"51","paragraphs":["para_214"]},{"title":"52","paragraphs":["para_216"]},{"title":"53","paragraphs":["para_218"]},{"title":"54","paragraphs":["para_220"]},{"title":"55","paragraphs":["para_222"]},{"title":"56","paragraphs":["para_224"]},{"title":"57","paragraphs":["para_226"]},{"title":"58","paragraphs":["para_228"]},{"title":"59","paragraphs":["para_230"]},{"title":"60","paragraphs":["para_232"]},{"title":"61","paragraphs":["para_234"]},{"title":"62","paragraphs":["para_236"]},{"title":"63","paragraphs":["para_238"]},{"title":"64","paragraphs":["para_240"]},{"title":"65","paragraphs":["para_242"]},{"title":"66","paragraphs":["para_244"]},{"title":"67","paragraphs":["para_246"]},{"title":"68","paragraphs":["para_248"]},{"title":"69","paragraphs":["para_250"]},{"title":"70","paragraphs":["para_252"]},{"title":"71","paragraphs":["para_254"]},{"title":"72","paragraphs":["para_256"]},{"title":"73","paragraphs":["para_258"]},{"title":"The second question","paragraphs":[]},{"title":"74","paragraphs":["para_261"]},{"title":"75","paragraphs":["para_263"]},{"title":"76","paragraphs":["para_265"]},{"title":"77","paragraphs":["para_267"]},{"title":"78","paragraphs":["para_269"]},{"title":"79","paragraphs":["para_271"]},{"title":"80","paragraphs":["para_273"]},{"title":"81","paragraphs":["para_275"]},{"title":"82","paragraphs":["para_277"]},{"title":"83","paragraphs":["para_279"]},{"title":"84","paragraphs":["para_281"]},{"title":"85","paragraphs":["para_283"]},{"title":"86","paragraphs":["para_285"]},{"title":"87","paragraphs":["para_287"]},{"title":"88","paragraphs":["para_289"]},{"title":"89","paragraphs":["para_291"]},{"title":"90","paragraphs":["para_293"]},{"title":"91","paragraphs":["para_295"]},{"title":"92","paragraphs":["para_297"]},{"title":"93","paragraphs":["para_299"]},{"title":"94","paragraphs":["para_301"]},{"title":"Costs","paragraphs":[]},{"title":"95","paragraphs":["para_304"]},{"title":"On those grounds, the Court (Grand Chamber) hereby rules:","paragraphs":["para_306","para_307","para_308","para_309","para_310","para_311","para_312","para_313","para_314"]}],"paragraphs":[{"text":"62023CJ0021","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Grand Chamber)","paragraph_id":"para_2"},{"text":"4 October 2024 (\n *1\n ) (\n i\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Chapter VIII – Remedies – Medicinal products marketed by a pharmacist on an online platform – Action brought before the national civil courts by a competitor of that pharmacist on the basis of the prohibit …","paragraph_id":"para_4"},{"text":"In Case C‑21/23,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Bundesgerichtshof (Federal Court of Justice, Germany), made by decision of 12 January 2023, received at the Court on 19 January 2023, in the proceedings","paragraph_id":"para_6"},{"text":"ND","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"DR,","paragraph_id":"para_9"},{"text":"THE COURT (Grand Chamber),","paragraph_id":"para_10"},{"text":"composed of K. Lenaerts, President, L. Bay Larsen, Vice-President, K. Jürimäe, C. Lycourgos, E. Regan, F. Biltgen and N. Piçarra, Presidents of Chambers, S. Rodin, P.G. Xuereb, L.S. Rossi, I. Jarukaitis, N. Jääskinen and I. Ziemele (Rapporteur), Judges,","paragraph_id":"para_11"},{"text":"Advocate General: M. Szpunar,","paragraph_id":"para_12"},{"text":"Registrar: N. Mundhenke, Administrator,","paragraph_id":"para_13"},{"text":"having regard to the written procedure and further to the hearing on 9 January 2024,","paragraph_id":"para_14"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_15"},{"text":"–","paragraph_id":"para_16"},{"text":"ND, by A. Datta, M. Mogendorf and W. Spoerr, Rechtsanwälte,","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"DR, by M. Bahmann, Rechtsanwalt,","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"the German Government, by J. Möller and P.‑L. Krüger, acting as Agents,","paragraph_id":"para_21"},{"text":"–","paragraph_id":"para_22"},{"text":"the European Commission, by A. Bouchagiar, F. Erlbacher and H. Kranenborg, acting as Agents,","paragraph_id":"para_23"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 25 April 2024,","paragraph_id":"para_24"},{"text":"gives the following","paragraph_id":"para_25"},{"text":"Judgment","paragraph_id":"para_26"},{"text":"1","paragraph_id":"para_27"},{"text":"This request for a preliminary ruling concerns the interpretation of Article 9(1) and the provisions in Chapter VIII of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on t …","paragraph_id":"para_28"},{"text":"2","paragraph_id":"para_29"},{"text":"The request has been made in proceedings between ND and DR, two natural persons each operating a pharmacy, concerning the marketing by ND, on an online platform, of pharmacy-only medicinal products.","paragraph_id":"para_30"},{"text":"Legal context","paragraph_id":"para_31"},{"text":"European Union law","paragraph_id":"para_32"},{"text":"3","paragraph_id":"para_33"},{"text":"Article 8 of Directive 95/46, entitled ‘The processing of special categories of data’, provided:","paragraph_id":"para_34"},{"text":"‘1.   Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life.","paragraph_id":"para_35"},{"text":"2.   Paragraph 1 shall not apply where:","paragraph_id":"para_36"},{"text":"(a)","paragraph_id":"para_37"},{"text":"the data subject has given his explicit consent to the processing of those data, except where the laws of the Member State provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject’s giving his consent; or","paragraph_id":"para_38"},{"text":"…’","paragraph_id":"para_39"},{"text":"4","paragraph_id":"para_40"},{"text":"Recitals 9 to 11, 13, 35, 51, 53, 141 and 142 of the GDPR are worded as follows:","paragraph_id":"para_41"},{"text":"‘(9)","paragraph_id":"para_42"},{"text":"The objectives and principles of Directive [95/46] remain sound, but it has not prevented fragmentation in the implementation of data protection across the Union, legal uncertainty or a widespread public perception that there are significant risks to the protection of natural persons, in particular …","paragraph_id":"para_43"},{"text":"(10)","paragraph_id":"para_44"},{"text":"In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member …","paragraph_id":"para_45"},{"text":"(11)","paragraph_id":"para_46"},{"text":"Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States.","paragraph_id":"para_47"},{"text":"…","paragraph_id":"para_48"},{"text":"(13)","paragraph_id":"para_49"},{"text":"In order to ensure a consistent level of protection for natural persons throughout the Union and to prevent divergences hampering the free movement of personal data within the internal market, a Regulation is necessary to provide legal certainty and transparency for economic operators, including mic …","paragraph_id":"para_50"},{"text":"…","paragraph_id":"para_51"},{"text":"(35)","paragraph_id":"para_52"},{"text":"Personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject.","paragraph_id":"para_53"},{"text":"…","paragraph_id":"para_54"},{"text":"(51)","paragraph_id":"para_55"},{"text":"Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. … Such personal data should not be processed, unless pro …","paragraph_id":"para_56"},{"text":"…","paragraph_id":"para_57"},{"text":"(53)","paragraph_id":"para_58"},{"text":"Special categories of personal data which merit higher protection should be processed for health-related purposes only where necessary to achieve those purposes for the benefit of natural persons and society as a whole, in particular in the context of the management of [healthcare] services and syst …","paragraph_id":"para_59"},{"text":"…","paragraph_id":"para_60"},{"text":"(141)","paragraph_id":"para_61"},{"text":"Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the [Charter of Fundamental Rights of the European Uni …","paragraph_id":"para_62"},{"text":"(142)","paragraph_id":"para_63"},{"text":"Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the right to mandate a not-for-profit body, organisation or association which is constituted in accordance with the law of a Member State, has statutory objectives which are in the public …","paragraph_id":"para_64"},{"text":"5","paragraph_id":"para_65"},{"text":"Article 1 of that regulation, entitled ‘Subject matter and objectives’, provides:","paragraph_id":"para_66"},{"text":"‘1.   This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.","paragraph_id":"para_67"},{"text":"2.   This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.","paragraph_id":"para_68"},{"text":"3.   The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.’","paragraph_id":"para_69"},{"text":"6","paragraph_id":"para_70"},{"text":"Article 4 of that regulation provides:","paragraph_id":"para_71"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_72"},{"text":"(1)","paragraph_id":"para_73"},{"text":"“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;","paragraph_id":"para_74"},{"text":"(2)","paragraph_id":"para_75"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_76"},{"text":"…","paragraph_id":"para_77"},{"text":"(7)","paragraph_id":"para_78"},{"text":"“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;","paragraph_id":"para_79"},{"text":"…","paragraph_id":"para_80"},{"text":"(15)","paragraph_id":"para_81"},{"text":"“data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;","paragraph_id":"para_82"},{"text":"…","paragraph_id":"para_83"},{"text":"(21)","paragraph_id":"para_84"},{"text":"“supervisory authority” means an independent public authority which is established by a Member State pursuant to Article 51;","paragraph_id":"para_85"},{"text":"…’","paragraph_id":"para_86"},{"text":"7","paragraph_id":"para_87"},{"text":"Chapter II of the GDPR, entitled ‘Principles’, comprises Articles 5 to 11 of the regulation.","paragraph_id":"para_88"},{"text":"8","paragraph_id":"para_89"},{"text":"Article 5 of that regulation sets out the principles relating to the processing of personal data, whereas Article 6 of that regulation lays down the conditions for lawful processing.","paragraph_id":"para_90"},{"text":"9","paragraph_id":"para_91"},{"text":"In the words of Article 9 of that regulation, entitled ‘Processing of special categories of personal data’:","paragraph_id":"para_92"},{"text":"‘1.   Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.","paragraph_id":"para_93"},{"text":"2.   Paragraph 1 shall not apply if one of the following applies:","paragraph_id":"para_94"},{"text":"(a)","paragraph_id":"para_95"},{"text":"the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;","paragraph_id":"para_96"},{"text":"…","paragraph_id":"para_97"},{"text":"(h)","paragraph_id":"para_98"},{"text":"processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;","paragraph_id":"para_99"},{"text":"…’","paragraph_id":"para_100"},{"text":"10","paragraph_id":"para_101"},{"text":"Article 51 of the GDPR, entitled ‘Supervisory authority’, provides, in paragraph 1:","paragraph_id":"para_102"},{"text":"‘Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (“supervisory authority”).’","paragraph_id":"para_103"},{"text":"11","paragraph_id":"para_104"},{"text":"Chapter VIII of the GDPR, entitled ‘Remedies, liability and penalties’, comprises Articles 77 to 84 of that regulation.","paragraph_id":"para_105"},{"text":"12","paragraph_id":"para_106"},{"text":"Article 77 of that regulation, entitled ‘Right to lodge a complaint with a supervisory authority’, provides, in paragraph 1:","paragraph_id":"para_107"},{"text":"‘Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.’","paragraph_id":"para_108"},{"text":"13","paragraph_id":"para_109"},{"text":"Article 78 of that regulation, entitled ‘Right to an effective judicial remedy against a supervisory authority’, states, in paragraph 1:","paragraph_id":"para_110"},{"text":"‘Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.’","paragraph_id":"para_111"},{"text":"14","paragraph_id":"para_112"},{"text":"Article 79 of that regulation, entitled ‘Right to an effective judicial remedy against a controller or processor’, provides, in paragraph 1:","paragraph_id":"para_113"},{"text":"‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.’","paragraph_id":"para_114"},{"text":"15","paragraph_id":"para_115"},{"text":"Article 80 of the GDPR, entitled ‘Representation of data subjects’, is worded as follows:","paragraph_id":"para_116"},{"text":"‘1.   The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data …","paragraph_id":"para_117"},{"text":"2.   Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject’s mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.’","paragraph_id":"para_118"},{"text":"16","paragraph_id":"para_119"},{"text":"Article 82 of that regulation, entitled ‘Right to compensation and liability’, provides, in paragraph 1:","paragraph_id":"para_120"},{"text":"‘Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.’","paragraph_id":"para_121"},{"text":"17","paragraph_id":"para_122"},{"text":"Article 83 of that regulation, entitled ‘General conditions for imposing administrative fines’, provides, in paragraph 1:","paragraph_id":"para_123"},{"text":"‘Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.’","paragraph_id":"para_124"},{"text":"18","paragraph_id":"para_125"},{"text":"Article 84 of that regulation, entitled ‘Penalties’, provides, in paragraph 1:","paragraph_id":"para_126"},{"text":"‘Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive.’","paragraph_id":"para_127"},{"text":"19","paragraph_id":"para_128"},{"text":"Article 94 of the GDPR stipulates, in paragraph 1:","paragraph_id":"para_129"},{"text":"‘Directive [95/46] is repealed with effect from 25 May 2018.’","paragraph_id":"para_130"},{"text":"20","paragraph_id":"para_131"},{"text":"Article 99 of the regulation provides:","paragraph_id":"para_132"},{"text":"‘1.   This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .","paragraph_id":"para_133"},{"text":"2.   It shall apply from 25 May 2018.’","paragraph_id":"para_134"},{"text":"German law","paragraph_id":"para_135"},{"text":"Law against unfair competition","paragraph_id":"para_136"},{"text":"21","paragraph_id":"para_137"},{"text":"Paragraph 3 of the Gesetz gegen den unlauteren Wettbewerb (Law against unfair competition) of 3 July 2004 (BGB1. 2004 I, p. 1414), in the version applicable to the main proceedings (‘the UWG’), entitled ‘Prohibition of unfair commercial practices’, provides, in subparagraph 1:","paragraph_id":"para_138"},{"text":"‘Unfair commercial practices shall be prohibited.’","paragraph_id":"para_139"},{"text":"22","paragraph_id":"para_140"},{"text":"Paragraph 3a of the UWG, entitled ‘Infringement of the law’, is worded as follows:","paragraph_id":"para_141"},{"text":"‘Anyone who infringes a statutory provision intended, inter alia, to regulate market conduct in the interest of market players acts unfairly where that infringement is capable of having an appreciable adverse effect on consumers, other market players or competitors.’","paragraph_id":"para_142"},{"text":"23","paragraph_id":"para_143"},{"text":"Paragraph 8 of that law, entitled ‘Cease and desist and prohibitory injunction’, states:","paragraph_id":"para_144"},{"text":"‘(1)   Any commercial practice which is prohibited under Paragraph 3 or Paragraph 7 may give rise to an order to cease and desist and, where there is a risk of recurrence, a prohibitory injunction. …","paragraph_id":"para_145"},{"text":"…","paragraph_id":"para_146"},{"text":"(3)   The injunctive relief referred to in subparagraph 1 may be claimed by:","paragraph_id":"para_147"},{"text":"1.","paragraph_id":"para_148"},{"text":"any competitor who markets or requests goods or services in a non-negligible and non-occasional manner,","paragraph_id":"para_149"},{"text":"…’","paragraph_id":"para_150"},{"text":"Law on the marketing of medicinal products","paragraph_id":"para_151"},{"text":"24","paragraph_id":"para_152"},{"text":"The movement of medicinal products is governed by the Gesetz über den Verkehr mit Arzneimitteln (Law on the marketing of medicinal products) of 24 August 1976 (BGBl. 1976 I, p. 2444), in the version published on 12 December 2005 (BGBl. 2005 I, p. 3394), as applicable to the facts in the main proceed …","paragraph_id":"para_153"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_154"},{"text":"25","paragraph_id":"para_155"},{"text":"ND, who operates a pharmacy under the trade name ‘Lindenapotheke’, has been marketing, since 2017, pharmacy-only medicinal products on the online platform ‘Amazon-Marketplace’ (‘Amazon’). When ordering those medicinal products online, ND’s customers must enter information, such as their name, the delivery address and details required for individualising the products.","paragraph_id":"para_156"},{"text":"26","paragraph_id":"para_157"},{"text":"DR, who also operates a pharmacy, brought an action before the Landgericht Dessau-Roßlau (Regional Court, Dessau-Roßlau, Germany) seeking an order for ND to cease, subject to periodic penalty payments, marketing on Amazon pharmacy-only medicinal products, so long as there is no guarantee that customers will be able to give their prior consent to the processing of data concerning health.","paragraph_id":"para_158"},{"text":"27","paragraph_id":"para_159"},{"text":"In support of his action, DR claimed that the marketing on Amazon of pharmacy-only medicinal products was unfair, on account of the failure to comply with the legal requirements for obtaining the customer’s consent required by the legislation on the protection of personal data.","paragraph_id":"para_160"},{"text":"28","paragraph_id":"para_161"},{"text":"By decision of 28 March 2018, the Landgericht Dessau-Roßlau (Regional Court, Dessau-Roßlau) upheld the action.","paragraph_id":"para_162"},{"text":"29","paragraph_id":"para_163"},{"text":"ND brought an appeal against that decision before the Oberlandesgericht Naumburg (Higher Regional Court, Naumburg, Germany), which dismissed the appeal by decision of 7 November 2019.","paragraph_id":"para_164"},{"text":"30","paragraph_id":"para_165"},{"text":"The appeal court held that the marketing on Amazon of pharmacy-only medicinal products constituted an unfair practice and was therefore prohibited under Paragraph 3(1) of the UWG. In its view, such marketing of medicinal products entails the processing of data concerning health, which is prohibited …","paragraph_id":"para_166"},{"text":"31","paragraph_id":"para_167"},{"text":"ND lodged an appeal on a point of law with the Bundesgerichtshof (Federal Court of Justice, Germany), which is the referring court.","paragraph_id":"para_168"},{"text":"32","paragraph_id":"para_169"},{"text":"That court states that the outcome of the dispute depends on the interpretation of Chapter VIII of the GDPR and Article 9(1) of that regulation, as well as Article 8(1) of Directive 95/46.","paragraph_id":"para_170"},{"text":"33","paragraph_id":"para_171"},{"text":"In the first place, the referring court asks whether, since the repeal of Directive 95/46 with effect from 25 May 2018, the date from which the GDPR became applicable, it is still open to the Member States to make provision, under national law, for competitors of an undertaking, such as those referr …","paragraph_id":"para_172"},{"text":"34","paragraph_id":"para_173"},{"text":"The referring court observes that that question gives rise to divergent answers at national level. Such an answer cannot be inferred unequivocally either from the wording of the provisions of Chapter VIII of the GDPR or from the general scheme of those provisions or from the objective pursued by that regulation.","paragraph_id":"para_174"},{"text":"35","paragraph_id":"para_175"},{"text":"Thus, first of all, as regards the wording of the provisions of Chapter VIII of the GDPR, the referring court states that, admittedly, those provisions do not mention anywhere the possibility for competitors of an undertaking to bring an action against that undertaking, in particular where the infringement of data protection legislation constitutes unfair commercial practices. However, at the same time, those provisions do not formally exclude that possibility.","paragraph_id":"para_176"},{"text":"36","paragraph_id":"para_177"},{"text":"As regards, next, the general scheme of the provisions of Chapter VIII of the GDPR, the referring court points out that, on the one hand, as the Court held in the judgment of 28 April 2022, Meta Platforms Ireland ( C‑319/20 , EU:C:2022:322 , paragraph  57 ), that regulation seeks to ensure the harmo …","paragraph_id":"para_178"},{"text":"37","paragraph_id":"para_179"},{"text":"Finally, as regards the objective of harmonisation and, in particular, of unification of the level of monitoring of the application of the law within the European Union pursued by the GDPR, the referring court states, first, that the fact that competitors may have standing to bring proceedings under …","paragraph_id":"para_180"},{"text":"38","paragraph_id":"para_181"},{"text":"Second, according to the referring court, allowing competitors to bring proceedings under competition law could constitute a further possibility of monitoring the application of the law, which is desirable under the principle of effectiveness (‘ effet utile ’) in order to ensure the highest possible level of protection of personal data, in accordance with recital 10 of the GDPR.","paragraph_id":"para_182"},{"text":"39","paragraph_id":"para_183"},{"text":"The referring court notes that that question has not been clarified by the case-law of the Court of Justice and that, in particular, in the judgment of 28 April 2022, Meta Platforms Ireland ( C‑319/20 , EU:C:2022:322 ), the Court expressly left open the question of a competitor’s standing to bring proceedings.","paragraph_id":"para_184"},{"text":"40","paragraph_id":"para_185"},{"text":"In the second place, the referring court asks whether the data which customers must enter on the online sales platform when ordering medicinal products, such as their name, the delivery address and the information required for individualising the medicinal products ordered, constitute ‘data concerning health’ within the meaning of Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR.","paragraph_id":"para_186"},{"text":"41","paragraph_id":"para_187"},{"text":"According to that court, the answer to that question is not obvious where the medicinal products ordered do not require a prescription. In such a case, it is conceivable that those medicinal products may be intended not for the customers themselves but for third parties, who may not be identifiable.","paragraph_id":"para_188"},{"text":"42","paragraph_id":"para_189"},{"text":"The referring court points out that the wording of those provisions and that of Article 4(15) of the GDPR, read in conjunction with recital 35 of that regulation, do not, on their own, provide an answer to that question.","paragraph_id":"para_190"},{"text":"43","paragraph_id":"para_191"},{"text":"However, in paragraph 125 of the judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija ( C‑184/20 , EU:C:2022:601 ), the Court held that the concept of ‘special categories of personal data’, referred to in Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR, must be interpreted …","paragraph_id":"para_192"},{"text":"44","paragraph_id":"para_193"},{"text":"The referring court states that the right to injunctive relief, relied on by DR, presupposes that ND’s conduct at issue was prohibited both at the time when it was adopted and at the time when the hearing in the appeal on a point of law took place, and that the first of those periods of time was still governed by Article 8(1) of Directive 95/46, whereas the second is now covered by Article 9(1) of the GDPR.","paragraph_id":"para_194"},{"text":"45","paragraph_id":"para_195"},{"text":"It was in that context that the Bundesgerichtshof (Federal Court of Justice) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_196"},{"text":"‘(1)","paragraph_id":"para_197"},{"text":"Do the rules in Chapter VIII of [the GDPR] preclude national rules which – alongside the powers of intervention of the supervisory authorities responsible for monitoring and enforcing the regulation and the options for legal redress for data subjects – empower competitors to bring proceedings for infringements of [that regulation] against the infringer before the civil courts on the basis of the prohibition of unfair commercial practices?","paragraph_id":"para_198"},{"text":"(2)","paragraph_id":"para_199"},{"text":"Do the data that the customers of a pharmacist who acts as a seller on an online sales platform enter when ordering pharmacy-only but not prescription-only medicines on the sales platform (data such as the customer’s name, delivery address and information required for individualising the pharmacy-only medicine ordered) constitute data concerning health within the meaning of Article 9(1) of the GDPR and of Article 8(1) of [Directive 95/46]?’","paragraph_id":"para_200"},{"text":"Consideration of the questions referred","paragraph_id":"para_201"},{"text":"The first question","paragraph_id":"para_202"},{"text":"46","paragraph_id":"para_203"},{"text":"By its first question, the referring court seeks to ascertain whether the provisions of Chapter VIII of the GDPR must be interpreted as precluding national legislation which, alongside the powers of intervention of the supervisory authorities responsible for monitoring and enforcing that regulation …","paragraph_id":"para_204"},{"text":"47","paragraph_id":"para_205"},{"text":"It must be recalled, at the outset, that Chapter VIII of the GDPR governs, inter alia, the legal remedies enabling the protection of the data subject’s rights where his or her personal data have been the subject of processing that is allegedly contrary to the provisions of that regulation. The prote …","paragraph_id":"para_206"},{"text":"48","paragraph_id":"para_207"},{"text":"First, Article 77(1) of the GDPR provides that, without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority. Under Article 78(1) of that regulation, each natural or legal person has the right to an effective jud …","paragraph_id":"para_208"},{"text":"49","paragraph_id":"para_209"},{"text":"Second, in accordance with Article 80(1) of the GDPR, the data subject has the right to mandate a not-for-profit body, organisation or association, subject to certain conditions, to lodge a complaint on his or her behalf or to exercise, on his or her behalf, the rights referred to in Articles 77 to …","paragraph_id":"para_210"},{"text":"50","paragraph_id":"para_211"},{"text":"In the present case, it is apparent from the documents before the Court that ND, who operates a pharmacy, markets pharmacy-only medicinal products on Amazon and that, when ordering those medicinal products online, customers must enter data, such as their name, the delivery address and the informatio …","paragraph_id":"para_212"},{"text":"51","paragraph_id":"para_213"},{"text":"The case in the main proceedings therefore raises the question whether the GDPR precludes a competitor such as DR, who is not a data subject within the meaning of Article 4(1) of that regulation, from having standing to bring such an action before the national civil courts.","paragraph_id":"para_214"},{"text":"52","paragraph_id":"para_215"},{"text":"In that regard, it should be borne in mind that, in interpreting a provision of EU law it is necessary to consider not only its wording but also its context and the objectives pursued by the legislation of which it forms part (see, to that effect, judgment of 12 January 2023, Nemzeti Adatvédelmi és Információszabadság Hatóság, C‑132/21 , EU:C:2023:2 , paragraph  32 ).","paragraph_id":"para_216"},{"text":"53","paragraph_id":"para_217"},{"text":"As regards the wording of the provisions of Chapter VIII of the GDPR, it should be noted that none of them expressly rules out the possibility for a competitor of an undertaking to bring an action before the civil courts against that undertaking on the basis of the prohibition of unfair commercial p …","paragraph_id":"para_218"},{"text":"54","paragraph_id":"para_219"},{"text":"As regards the context of Chapter VIII of the GDPR, it should be noted that that regulation contains, in Chapter II, a set of substantive provisions relating, inter alia, to the principles relating to the processing of personal data, set out in Article 5, and to the conditions for lawful processing, …","paragraph_id":"para_220"},{"text":"55","paragraph_id":"para_221"},{"text":"That said, while the infringement of those substantive provisions is likely to affect primarily the data subjects concerned by the data at issue, it is also liable to adversely affect third parties, as illustrated by the fact that Article 82(1) of the GDPR provides for a right to compensation for ‘a …","paragraph_id":"para_222"},{"text":"56","paragraph_id":"para_223"},{"text":"In that context, it is important to recall that access to and use of personal data are of great importance in the context of the digital economy. Access to personal data and the ability to process such data have become a significant parameter of competition between undertakings in the digital econom …","paragraph_id":"para_224"},{"text":"57","paragraph_id":"para_225"},{"text":"Furthermore, while it is apparent from Article 1(1) of the GDPR, read in the light, inter alia, of recitals 9 and 13 thereof, that that regulation seeks to ensure the harmonisation of national legislation on the protection of personal data which is, in principle, full, the fact remains that several …","paragraph_id":"para_226"},{"text":"58","paragraph_id":"para_227"},{"text":"The Court has already held that this is the case of Article 80(2) of the GDPR, which leaves the Member States a margin of discretion with regard to its implementation and which does not preclude national legislation which allows a consumer protection association to bring legal proceedings, in the ab …","paragraph_id":"para_228"},{"text":"59","paragraph_id":"para_229"},{"text":"It is true that the provisions of Chapter VIII of the GDPR do not specifically provide for such an opening clause which would expressly allow Member States to make it possible for a competitor of an undertaking which allegedly infringes the substantive provisions of that regulation to bring an action in order to put an end to that infringement.","paragraph_id":"para_230"},{"text":"60","paragraph_id":"para_231"},{"text":"However, it follows from the wording and context of the provisions of Chapter VIII, recalled in paragraphs 53 to 58 above, that, by adopting that regulation, the EU legislature did not intend to bring about an exhaustive harmonisation of the remedies available in respect of infringements of the prov …","paragraph_id":"para_232"},{"text":"61","paragraph_id":"para_233"},{"text":"That interpretation is confirmed by the objectives pursued by the GDPR, which, as is apparent, inter alia, from recital 10 thereof, seeks to ensure a consistent and high level of protection of natural persons with regard to the processing of personal data and to remove obstacles to the flow of such …","paragraph_id":"para_234"},{"text":"62","paragraph_id":"para_235"},{"text":"The possibility for a competitor of an undertaking to bring an action before the civil courts on the basis of the prohibition of unfair commercial practices in order to put an end to an infringement of the substantive provisions of the GDPR, allegedly committed by that undertaking, not only does not …","paragraph_id":"para_236"},{"text":"63","paragraph_id":"para_237"},{"text":"In the first place, an application for injunctive relief brought by a competitor against an undertaking on the basis of the prohibition of unfair commercial practices, on account of the alleged infringement of the substantive provisions of the GDPR, in no way undermines the system of remedies provid …","paragraph_id":"para_238"},{"text":"64","paragraph_id":"para_239"},{"text":"It is true that such an application may be based, albeit incidentally, on an infringement of the same provisions of the GDPR as those on which a complaint or action brought, under Articles 77 to 79 of that regulation, by the data subjects or by a body, organisation or association, within the meaning of Article 80 thereof, may be based.","paragraph_id":"para_240"},{"text":"65","paragraph_id":"para_241"},{"text":"However, first, unlike Articles 77 to 80 of the GDPR, an application for injunctive relief brought by a competitor does not, as such, pursue an objective of protection of the fundamental rights and freedoms of data subjects with regard to the processing of their personal data, but seeks to ensure fair competition, in the interests, inter alia, of that competitor.","paragraph_id":"para_242"},{"text":"66","paragraph_id":"para_243"},{"text":"Second, the possibility for a competitor to bring such an action before the civil courts on the basis of the prohibition of unfair commercial practices is in addition to the remedies established in Articles 77 to 79 of the GDPR, which remain in full and can still be pursued by data subjects and, where appropriate, by bodies, organisations or associations within the meaning of Article 80 of that regulation.","paragraph_id":"para_244"},{"text":"67","paragraph_id":"para_245"},{"text":"In particular, as the German Government pointed out, the coexistence of remedies under data protection law and competition law does not create a risk for the uniform application of the GDPR. In that context, it must be stated that it follows from the wording of Articles 77 to 80 of that regulation t …","paragraph_id":"para_246"},{"text":"68","paragraph_id":"para_247"},{"text":"Third, as the Advocate General observed, in essence, in point 104 of his Opinion, the fact that the substantive provisions of the GDPR made be relied on more widely, by persons other than just data subjects and bodies, organisations and associations, within the meaning of Article 80 of that regulati …","paragraph_id":"para_248"},{"text":"69","paragraph_id":"para_249"},{"text":"In the second place, as regards the objective of ensuring effective protection of data subjects with regard to the processing of their personal data and the effectiveness of the substantive provisions of the GDPR, it must be held that, although an application for injunctive relief brought by a compe …","paragraph_id":"para_250"},{"text":"70","paragraph_id":"para_251"},{"text":"Moreover, such an application for injunctive relief brought by a competitor may prove, like that brought by a consumer protection association, to be particularly effective in ensuring such protection, in so far as it is capable of preventing a large number of infringements of the rights of data subjects by the processing of their personal data (see, to that effect, judgment of 28 April 2022, Meta Platforms Ireland, C‑319/20 , EU:C:2022:322 , paragraph  75 ).","paragraph_id":"para_252"},{"text":"71","paragraph_id":"para_253"},{"text":"It follows that the interpretation adopted in paragraph 60 above is consistent with the requirements stemming from Article 16(1) TFEU and Article 8 of the Charter and, thus, with the objective pursued by the GDPR consisting in ensuring effective protection of the fundamental rights and freedoms of n …","paragraph_id":"para_254"},{"text":"72","paragraph_id":"para_255"},{"text":"In the present case, it is for the referring court to ascertain whether the alleged infringement of the substantive provisions of the GDPR at issue in the main proceedings, in so far as it is established, also constitutes an infringement of the prohibition of unfair commercial practices laid down in the relevant national legislation.","paragraph_id":"para_256"},{"text":"73","paragraph_id":"para_257"},{"text":"In the light of the foregoing considerations, the answer to the first question is that the provisions of Chapter VIII of the GDPR must be interpreted as not precluding national legislation which, alongside the powers of intervention of the supervisory authorities responsible for monitoring and enfor …","paragraph_id":"para_258"},{"text":"The second question","paragraph_id":"para_259"},{"text":"74","paragraph_id":"para_260"},{"text":"By its second question, the referring court asks, in essence, whether Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR must be interpreted as meaning that, in a situation where the operator of a pharmacy markets pharmacy-only medicinal products on an online platform, the information whic …","paragraph_id":"para_261"},{"text":"75","paragraph_id":"para_262"},{"text":"Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR, the purport of which is similar for the purposes of the interpretation that the Court is required to give (judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C‑184/20 , EU:C:2022:601 , paragraphs  58 and  117 ) and which r …","paragraph_id":"para_263"},{"text":"76","paragraph_id":"para_264"},{"text":"Those special categories of personal data, listed in Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR, include data concerning health. Those data cover, in accordance with Article 4(15) of that regulation, read in conjunction with recital 35 of that regulation, all personal data which re …","paragraph_id":"para_265"},{"text":"77","paragraph_id":"para_266"},{"text":"In addition, it is apparent inter alia from Article 4(1) of the GDPR that the concept of ‘personal data’ means any information relating to an identified or identifiable natural person and that in order to be classified as an ‘identifiable’ person, it is sufficient that the person in question can be …","paragraph_id":"para_267"},{"text":"78","paragraph_id":"para_268"},{"text":"Thus, where the data on purchases of medicinal products allow conclusions to be drawn as to the health status of an identified or identifiable person, they must be regarded as data concerning health within the meaning of Article 4(15) of the GDPR.","paragraph_id":"para_269"},{"text":"79","paragraph_id":"para_270"},{"text":"In the present case, it is apparent from the documents before the Court that ND’s customers, when ordering pharmacy-only medicinal products online on Amazon, enter information such as their name, the delivery address and details for the individualisation of the medicinal products. That information undoubtedly constitutes ‘personal data’ given that it relates to identified or identifiable natural persons.","paragraph_id":"para_271"},{"text":"80","paragraph_id":"para_272"},{"text":"In those circumstances, it is necessary to determine whether such data are capable of revealing information about the health status of those persons, within the meaning of Article 4(15) of the GDPR, and, consequently, constitute data concerning health within the meaning of Article 8(1) of Directive 95/46 and Article 9(1) of that regulation.","paragraph_id":"para_273"},{"text":"81","paragraph_id":"para_274"},{"text":"In that regard, the Court has already held that, having regard to the objective of Directive 95/46 and the GDPR, which is to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular of their private life, with respect to the processing of personal da …","paragraph_id":"para_275"},{"text":"82","paragraph_id":"para_276"},{"text":"In particular, those provisions cannot be interpreted as meaning that the processing of personal data that are liable indirectly to reveal sensitive information concerning a natural person is excluded from the strengthened protection regime prescribed by those provisions, if the effectiveness of tha …","paragraph_id":"para_277"},{"text":"83","paragraph_id":"para_278"},{"text":"Therefore, in order for personal data to be classified as data concerning health, within the meaning of Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR, it is sufficient that they are capable of revealing information about the health status of the data subject by means of an intellectual operation involving collation or deduction (see, to that effect, judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C‑184/20 , EU:C:2022:601 , paragraph  123 ).","paragraph_id":"para_279"},{"text":"84","paragraph_id":"para_280"},{"text":"The data which a customer enters on an online platform when ordering pharmacy-only medicinal products are capable of revealing, by means of an intellectual operation involving collation or deduction, information on the health status of the data subject, within the meaning of Article 4(1) of the GDPR …","paragraph_id":"para_281"},{"text":"85","paragraph_id":"para_282"},{"text":"The referring court is uncertain, however, as to whether the fact that the sale of the medicinal products ordered does not require a prescription is relevant in so far as, in that case, those medicinal products could be intended not for the customer placing the order but for third parties.","paragraph_id":"para_283"},{"text":"86","paragraph_id":"para_284"},{"text":"In that regard, it must be noted that, for the purposes of applying Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR, it is important to ascertain, where personal data are processed by the operator of a pharmacy in the context of an activity carried out on an online platform, if those da …","paragraph_id":"para_285"},{"text":"87","paragraph_id":"para_286"},{"text":"That fundamental prohibition is independent of whether or not the information revealed by the processing operation in question is correct and of whether the data controller is acting with the aim of obtaining information that falls within one of the special categories referred to in Article 8(1) of …","paragraph_id":"para_287"},{"text":"88","paragraph_id":"para_288"},{"text":"It follows that, where a user of an online platform communicates personal data when ordering pharmacy-only medicinal products the sale of which does not require a prescription, the processing of those data by the operator of a pharmacy which sells those medicinal products on that online platform mus …","paragraph_id":"para_289"},{"text":"89","paragraph_id":"para_290"},{"text":"An interpretation of those provisions which would result in a distinction being made according to the type of medicinal product concerned and to whether or not the sale of those medicinal products requires a prescription would not be consistent with the objective of ensuring a high level of protecti …","paragraph_id":"para_291"},{"text":"90","paragraph_id":"para_292"},{"text":"Consequently, the information which customers of an operator of a pharmacy enter when ordering online pharmacy-only medicinal products the sale of which does not require a prescription constitutes data concerning health, within the meaning of Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR, even where it is only with a certain degree of probability, and not with absolute certainty, that those medicinal products are intended for those customers.","paragraph_id":"para_293"},{"text":"91","paragraph_id":"para_294"},{"text":"Moreover, it is not inconceivable that, even if such medicinal products are intended for persons other than the customers, it may be possible to identify those persons and draw conclusions about their health status. That could be the case, for example, where the medicinal products in question are de …","paragraph_id":"para_295"},{"text":"92","paragraph_id":"para_296"},{"text":"Lastly, as has been pointed out in paragraph 86 above, the fact that information such as that at issue in the main proceedings constitutes data concerning health, within the meaning of Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR, does not preclude it from being processed, as is appa …","paragraph_id":"para_297"},{"text":"93","paragraph_id":"para_298"},{"text":"This may in particular be the case, first, where, in accordance with point (a) of that paragraph 2, and subject to the exception provided for therein, the data subject gives explicit consent to one or more processing operations involving those personal data, the specific characteristics and purposes …","paragraph_id":"para_299"},{"text":"94","paragraph_id":"para_300"},{"text":"In the light of the foregoing, the answer to the second question is that Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR must be interpreted as meaning that, in a situation where the operator of a pharmacy markets pharmacy-only medicinal on an online platform, the information which the …","paragraph_id":"para_301"},{"text":"Costs","paragraph_id":"para_302"},{"text":"95","paragraph_id":"para_303"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_304"},{"text":"On those grounds, the Court (Grand Chamber) hereby rules:","paragraph_id":"para_305"},{"text":"1.","paragraph_id":"para_306"},{"text":"The provisions of Chapter VIII of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),","paragraph_id":"para_307"},{"text":"must be interpreted as not precluding national legislation which, alongside the powers of intervention of the supervisory authorities responsible for monitoring and enforcing that regulation and the remedies available to data subjects, confers on competitors of the person allegedly responsible for a …","paragraph_id":"para_308"},{"text":"2.","paragraph_id":"para_309"},{"text":"Article 8(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and Article 9(1) of Regulation 2016/679,","paragraph_id":"para_310"},{"text":"must be interpreted as meaning that, in a situation where the operator of a pharmacy markets pharmacy-only medicinal products on an online platform, the information which the customers of that operator enter when ordering the medicinal products online, such as their name, the delivery address and th …","paragraph_id":"para_311"},{"text":"[Signatures]","paragraph_id":"para_312"},{"text":"(\n *1\n ) Language of the case: German.","paragraph_id":"para_313"},{"text":"(\n i\n ) The wording of paragraph 76 of this document has been amended since it was first put online.","paragraph_id":"para_314"}],"word_count":10548,"cites":["C-319/20","C-184/20","C-132/21","C-252/21","C-101/01"],"sha256":"d71e92d077b33fe06c5d7ee433a713fdba8130a6e7953db6005523fb9f183d6e","source_url":"https://publications.europa.eu/resource/celex/62023CJ0021.ENG.xhtml.ECR_62023CJ0021_EN_01.html","fetched_at":"2026-09-30T07:48:00.066+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-21-23-62023cj0021","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-21-23-62023cj0021","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-21-23-62023cj0021","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-21-23-62023cj0021","verification":{"stored_sha256":"d71e92d077b33fe06c5d7ee433a713fdba8130a6e7953db6005523fb9f183d6e","recomputed_sha256":"d71e92d077b33fe06c5d7ee433a713fdba8130a6e7953db6005523fb9f183d6e","intact":true,"checked_at":"2026-10-15T07:23:48.846Z"}},"hash":"sha256:20afa79ffdfd24cebea2506bd6f64c2beeee376b3109e48708e8f167842ad342","version":"legal-2026-10-15","expires":"2026-10-16T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-15+legal-2026-10-15+2026-10-15T06:23:03","content_hash":"sha256:20afa79ffdfd24cebea2506bd6f64c2beeee376b3109e48708e8f167842ad342","revalidate_after":"2026-10-15T08:23:49.464Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-21-23-62023cj0021","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-21-23-62023cj0021"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-21-23-62023cj0021"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-21-23-62023cj0021"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":1},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-21-23-62023cj0021","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-cfc402a83cbe384b6c8bbab49b258880","response_hash":"sha256:20afa79ffdfd24cebea2506bd6f64c2beeee376b3109e48708e8f167842ad342"}},"freshness":{"freshness_class":"live","as_of":"2026-11-03T15:07:40.765Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-21-23-62023cj0021&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":20916}}