Court case I ZR 223/19 – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court ruled that a pharmacist selling non-prescription medicines on Amazon must get customer consent for processing health data. This is important because it reinforces the need for businesses to ask for permission before handling sensitive information. Online sellers should be careful about how they collect and use customer data.
What happened
The Court of Justice ruled that health data is collected when customers order pharmacy-only products online, requiring prior consent.
Who was affected
Customers ordering pharmacy-only but non-prescription medicines were affected.
What the authority found
The Court held that processing health data without customer consent violates GDPR rules.
Why this matters
This ruling sets a precedent for how online sales of health-related products must be handled. Businesses should ensure they have clear consent processes for any sensitive data they collect.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A pharmacist sold non-prescription but pharmacy-only medicine through Amazon requiring customers to enter their name, delivery address and the information necessary for the individualization of the medicines. On the basis of the German Act against Unfair Competition ([https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Gesetz gegen den unlauteren Wettbewerb – UWG]), a competitor sought an injunction prohibiting the controller from selling pharmacy-only but non-prescription medication through Amazon unless customers could express their consent to the data processing in advance. The competitor alleged that the sale through Amazon was unlawful under the GDPR as it did not ask for the prior consent of the customer’s as required under Article 9(2) GDPR for the processing of sensitive data. The Regional Court granted the claim. The first Court of Appeal dismissed the defendant's appeal. The defendant pursued its motion to dismiss the action with the appeal granted by the Court of Appeal. The BGH stayed the proceedings and referred the case to the CJEU for a preliminary ruling. The CJEU on 4 October 2024 held in C-21/23, Lindenapotheke that information entered by customers when ordering pharmacy-only medical products constitutes health data, even when the products are prescription-free. The Court further found that the GDPR does not preclude national law enabling a controller’s competitors to challenge GDPR infringements in court as prohibited unfair commercial practices. The court implemented the CJEU's decision. Thus, it held, that if a customer orders prescription-only medications via a pharmacist's account on Amazon, health data is collected and processed within the meaning of of the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) and Article 9 GDPR. Additionally, the court held, that the processing of order data without express consent pursuant to Article 9(2)(a) GDPR constitutes a violation of a market conduct regulation pursuant to the
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case I ZR 223/19 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case I ZR 223/19 - Germany (2025). Retrieved from cookiefines.eu
Last updated: