Online Pharmacy – Court Ruling (Germany, 2021)

The controller operates an online pharmacy located in Germany. The pharmacy allowed customers to order medical products with or without a customer account. For any order without an account, however, customers were required to enter their title (Ms./Mr.) and their date of birth in the online form. After receiving a complaint from a data subject, the LfD (DPA of Lower Saxony) investigated the case. The controller argued that information on the date of birth was required to ensure the full legal capacity of the customer and was therefore necessary to perform the contract. Furthermore, obtaining the birth date was required to comply with legal obligations. Since medications were generally associated with health risks and side effects and they must be dosed appropriately for the customer’s age. In terms of the title, the controller argued that collecting such data would allow for a more customer-friendly communication and therefore serve an overriding legitimate interest. The DPA found that the blanket collection of such data irrespective of a gender or age specific application of the ordered medication violates the principles of lawfulness and data minimization. Accordingly, the corresponding query must be omitted if it is not necessary for a gender- or age-appropriate dosing. Furthermore, the controller lacked to mention the purpose of collecting gender data to pursue legitimate interests which violates the principle of transparency. Consequently, the DPA ordered the controller to refrain from the collection of such information in the online ordering process where the necessity of such information is not indicated by the type of the medication ordered. The Administrative Court of Hanover held that the DPA’s order against the online pharmacy is lawful and does not violate the controller’s rights. While the controller has special contractual duties to provide information on their products and proper use, including an age-appropriate dosage, this does not justify the collection of the date of birth for all orders. Many products in the controller’s assortment (e.g. plasters, bandages, creams, etc.) were applicable irrespective of the customer’s age. In such cases, the processing of the birth date cannot be founded on Article 6(1)(b) GDPR. Similarly, there is no evident legal obligation to obtain this data for non-prescriptive medication that does not require an age-dependent dosage in terms of Article 6(1)(c) GDPR. Similarly, the court held that the collection of data on the gender and birth date within orders of such products could not be based on Article 6(1)(f) GDPR. Regarding the birth date, asking for the age of majority represents a milder mean instead. In terms of the title, a gender-neutral communication may be addressed. However, the controller had already taken measures during the procedure, adding an option of “do not specify” in the title section along with additional information in their privacy policy.