The European Court of Justice (ECJ) has issued a landmark ruling on the processing of health data when ordering medicines online. On October 4, 2024, the court ruled in case C-21/23 on important questions regarding the application of the General Data Protection Regulation (GDPR) in the online trade in medicines.
The ECJ ruling on health data when ordering medicines online concerns a legal dispute between two German pharmacists. It clarifies that order data of non-prescription medicines are to be regarded as health data within the meaning of the GDPR. This decision has far-reaching consequences for the Privacy and the e-Health in Germany.
Digitalization in the healthcare sector is advancing, and this ruling sets new standards for the handling of sensitive data. Online pharmacies must now review and adapt their data protection practices to meet the strict requirements of the GDPR.
Key findings
- Order data for pharmacy-only medicines is considered health data
- Violations of the GDPR can be asserted in competition law claims
- Online pharmacies must clearly inform customers about data processing
- Customers' express consent is required for data processing
- The ruling strengthens the Privacy in the digital health sector
Background to the ECJ ruling
The ruling of the European Court of Justice (ECJ) has far-reaching implications for the Mail order pharmaceuticals and the Patients' rights in Germany. It arose from a legal dispute between pharmacists and concerns the cross-border mail-order sale of medicines.
Legal dispute between pharmacists
A registered pharmacist took legal action against a mail-order pharmacy operator that sold non-prescription medicines via Amazon. The accusation was based on unauthorized processing of health data and unfair competition.
Questions referred by the Federal Court of Justice
The Federal Court of Justice (BGH) referred questions on the interpretation of the GDPR to the ECJ:
- Are competition claims for GDPR violations admissible?
- Is order data for over-the-counter medicines considered health data?
Significance for the online trade in medicinal products
The ruling is of great significance for the Mail order pharmaceuticals and the application of the GDPR in this area. It concerns both national and cross-border transactions.
| Aspect | Before the verdict | After the judgment |
|---|---|---|
| Health data | Narrow definition | Extended definition |
| Competition claims | Unclear legal situation | Permissible in the event of GDPR violations |
| Mail order | Less regulation | Stricter data protection requirements |
The ECJ ruling strengthens the Patients' rights in the digital space and sets new standards for the Privacy in the Mail order pharmaceuticals. It calls on online pharmacies to be more transparent and handle customer data more carefully.
ECJ judgment Health data Online ordering of medicinal products
The European Court of Justice issued a landmark ruling on October 4, 2024. It concerns the online ordering of medicines and the handling of customer data. The court now classifies order information as health data.
According to the ECJ, name, delivery address and medication details are considered sensitive data. This also applies to non-prescription medicines. Customers must give their express consent for this data to be processed.
The ruling strengthens data protection in the online trade in pharmaceuticals. It allows competitors to take action against infringements. Pharmacies must review and adapt their processes.
The ECJ's decision aims to strengthen the rights of data subjects and ensure a high level of protection.
This judgment influences the Distance selling law and the application of the General Data Protection Regulation. Online pharmacies must now provide transparent information and obtain consent. Sales via platforms such as Amazon require particular caution when processing data.
Key statements of the ECJ ruling
The ruling of the European Court of Justice (ECJ) of 11 December 2003 brings important innovations for digitalization in the healthcare sector. It concerns the online trade in medicines and the protection of patients' rights.
Classification of order data as health data
The ECJ classifies order data for medicinal products as health data. This data can allow conclusions to be drawn about a person's state of health. This has consequences for data protection when ordering medicines online.
Admissibility of competition law claims for GDPR infringements
The court allows competition law suits for violations of the General Data Protection Regulation (DSGVO). This strengthens the enforcement of data protection law in the pharmacy market. Online pharmacies must review their data protection practices.
Data processing requirements for online orders
Pharmacies must provide customers with comprehensive information when ordering online. Explicit consent to data processing is often required. These rules are intended to ensure a high level of protection for personal data. They also concern the growing Telemedicine.
The ruling shows: The protection of health data has priority. Online pharmacies must adapt their processes. Patients get more control over their data. Digitalization in the healthcare sector must take data protection and Patients' rights note.
Definition of health data according to GDPR
In its ruling of October 4, 2024, the European Court of Justice (ECJ) defined the concept of health data in the context of the e-Health is defined broadly. This interpretation particularly affects the online trade in medicinal products and has a significant impact on data protection.
According to the ECJ, health data does not only include information on prescription medicines. Data on pharmacy-only but over-the-counter medicines is also included. The reasoning: This information can be used to draw conclusions about a person's state of health.
Important for patients' rights: This definition applies regardless of whether the order is placed for the customer themselves or for another person. Online pharmacies must therefore exercise particular caution when processing such data.
"Health data is any information that allows conclusions to be drawn about the state of health of an identifiable person."
This broad interpretation of the term "health data" has far-reaching consequences for the healthcare industry. Companies must review their data protection practices and adapt them where necessary in order to meet the strict requirements of the GDPR.
Effects on the online trade in medicinal products
The ECJ ruling brings with it far-reaching changes for the mail-order pharmaceutical trade. The cross-border mail-order trade in medicines is facing new challenges that will affect the business model of many online pharmacies.
Consent for data processing
In future, online pharmacies will have to obtain the express consent of their customers before they are allowed to process their health data. This applies in particular to information on purchased medicines and medical conditions. Consent must be voluntary, specific and informed.
Transparency requirements for online pharmacies
The Distance selling law obliges online pharmacies to be more transparent. They must inform customers clearly and comprehensibly about the exact circumstances and purposes of data processing. This includes details on data storage, use and possible disclosure to third parties.
Restrictions on the distribution of medicinal products via platforms
The sale of medicines via large online platforms could be made more difficult. These must meet the strict data protection requirements, which will not always be possible. This could give smaller, specialized online pharmacies a competitive advantage.
"In Germany, the mail-order sale of medicines has been permitted by law for 20 years, which gives us a head start in adapting to new regulations."
Online pharmacies must review and adapt their processes in order to meet the new requirements. This concerns both technical and organizational measures in the mail-order pharmaceutical trade. The implementation of these changes will require time and resources, but is essential for lawful operation in the online pharmacy market.
Legal basis for the processing of health data
The General Data Protection Regulation (GDPR) forms the foundation for the handling of health data in the digital age. It plays a central role in the digitalization of the healthcare sector and the development of the e-Health.
According to the ECJ ruling, the processing of health data is generally prohibited. There are only exceptions in the case of express consent in accordance with Art. 9 para. 2 lit. a GDPR or if other exceptions apply.
For online pharmacies, Art. 9 para. 2 lit. h GDPR can be considered as an alternative legal basis. This permits data processing for the purposes of preventive healthcare. Pharmacies must carefully check which legal basis applies to their specific data processing.
- Careful documentation of the chosen legal basis
- Compliance with the transparency requirements of the GDPR
- Ensuring data security in accordance with Art. 32 GDPR
Compliance with these legal requirements is crucial for the secure and trustworthy handling of health data in the context of e-health and the ongoing digitalization of the healthcare sector.
Significance for competition in the pharmacy market
The ruling of the European Court of Justice on mail-order pharmaceuticals has far-reaching consequences for the pharmacy market. It opens up new perspectives for competition and puts existing business models to the test.
New opportunities for competition law claims
As a result of the ECJ ruling, pharmacists can now denounce breaches of the GDPR as unfair business practices. One example of this is the case of a Munich pharmacist who sued a colleague for selling over-the-counter medicines on Amazon. This could lead to increased scrutiny of data protection practices in the online pharmaceutical trade.
Potential impact on business models
Established business models, in particular sales via online platforms, are now under pressure. The question of whether order data for pharmacy-only medicines is considered health data could fundamentally change the mail-order pharmaceutical trade. Pharmacies may have to rethink their digital strategy and adapt processes to meet the new legal requirements.
The ECJ's decision could also have an impact on the Telemedicine have. Providers must now handle patient data with particular care and review their data protection practices. This could lead to a reorientation of the European pharmacy market and influence cross-border mail order business.
| Aspect | Impact |
|---|---|
| Competition law claims | Increase due to GDPR violations |
| Online platforms | Business models need to be adapted |
| Privacy | Increased controls in the mail-order pharmaceutical trade |
| Telemedicine | Review of data protection practices necessary |
Data protection obligations for online pharmacies
The ECJ ruling has tightened the data protection obligations for online pharmacies. The processing of health data must now take place on a lawful basis. As a rule, this means that customers must give their express consent.
Online pharmacies are facing new challenges. They must inform their customers clearly and comprehensibly about the purposes of data processing. This applies in particular to orders "on behalf of" if the customer and patient are not identical.
A ruling by the OVG Lower Saxony shows: Requesting the date of birth is often not justified. Name, address and telephone number are sufficient for identification. To check legal capacity, it is sufficient to ask for the age of majority.
- Review consent processes
- Adapt data protection declarations
- Mark date of birth fields as "optional"
These measures strengthen patient rights in the area of e-health. Online pharmacies must adapt their processes to harmonize data protection and customer service. Violations can result in severe penalties - up to 4% of annual global turnover.
"The request for the date of birth in the online ordering process does not have a sufficient legal basis under the GDPR."
Online pharmacies should urgently review their data protection practices. This is the only way they can meet the new requirements and retain the trust of their customers.
Differentiation between prescription and pharmacy-only medicines
The ECJ ruling of December 11, 2003 (case C-322/01) illustrates the complexity of the mail-order pharmaceutical trade. It shows that clear rules are needed for the healthcare sector and the digitalization of healthcare. Directive 2001/83/EC, which replaces the former Directive 65/65/EEC, creates a uniform framework for medicinal products in the EU.
At Distance selling law the distinction between prescription-only and pharmacy-only medicines plays an important role. According to Article 2 of Directive 92/26/EEC, national authorities must make this classification. Strict advertising rules apply to both categories, as laid down in Directive 92/28/EEC.
The On-Site Pharmacy Strengthening Act (VOASG) of 2020 aims to strengthen the local supply of medicines and regulate the mail-order business. It requires foreign mail-order pharmacies to adhere to German price maintenance for prescription medicines. This regulation has a significant impact on the mail-order pharmaceutical trade and highlights the challenges of digitalization in the healthcare sector.
English 
Deutsch 
Español 
Français 
Polski