- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
CJEU case C‑21/23 Lindenapotheke – CJEU Judgment (Germany, 2024)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
The Court of Justice ruled on a case involving a pharmacy that sold non-prescription medication online. It found that selling such medication without customer consent for data processing was against the law. This decision clarifies the need for consent when handling sensitive customer data.
What happened
The court addressed whether national laws can allow competitors to take action against GDPR violations related to selling pharmacy-only medications online.
Who was affected
Customers of the pharmacy who ordered medications online and had their personal data processed.
What the authority found
The Court held that the GDPR does not prevent national laws from allowing competitors to challenge GDPR violations through civil actions.
Why this matters
This ruling emphasizes the importance of consent in processing sensitive data and may encourage more scrutiny of online sales practices in the pharmacy sector.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 20 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The reference originates from a civil dispute between two competing pharmacists (the controller and DR) brought before a German regional court (Landgericht Dessau-Roßlau – LG Dessau-Roßlau). The controller sold non-prescription but pharmacy-only medicine through Amazon requiring customers to enter their name, delivery address and the information necessary for the individualization of the medicines. On the basis of the German legislation on unfair commercial practices, DR sought an injunction prohibiting the controller from selling pharmacy-only but non-prescription medication through Amazon unless customers could express their consent to the data processing in advance. DR alleged that the sale through Amazon was unlawful under the GDPR as it did not ask for the prior consent of the customer’s as required under Article 9(2) GDPR for the processing of sensitive data. The Regional Court and the Higher Regional Court (Oberlandesgericht Naumburg – OLG Naumburg) held that the marketing of pharmacy-only medication is contrary to paragraph 3 of a national law on unfair competition ([https://www.gesetze-im-internet.de/uwg_2004/__3.html §3 Gesetz gegen den unlauteren Wettbewerb (UWG)]). Also, without explicit consent from the customers, the processing is prohibited under the GDPR since it entails the processing of special categories of personal data. The controller then appealed the case to the Federal Court of Justice (Bundesgerichtshof - BGH) which referred to the CJEU the following preliminary questions: 1) Does the GDPR preclude national provisions which grant competitors the power to take action against the infringer for infringements of the GDPR by way of an action before the civil courts under the prohibition of unfair commercial practices? 2) Are the data of an online pharmacist’s customers in connection with online-orders for pharmacy-only (but not prescription-only) medicines health data within the meaning of Article 9(1) GDPR? 1. First question (Chapter VII
Outcome
CJEU Case
A judgment or Advocate General opinion in a case before the Court of Justice of the European Union.
Related Cases (0)
No other cases found for CJEU case C‑21/23 Lindenapotheke in DE
This is the only recorded case for this entity in this jurisdiction.
Details
Judgment Date
4 October 2024
Authority
Court of Justice of the European Union
About this data
Cite as: Cookie Fines. CJEU case C‑21/23 Lindenapotheke - Germany (2024). Retrieved from cookiefines.eu
Last updated: