| It follows from a decision also handed down on 4 October 2020 (Case C-21/23) that, in the opinion of the European Court of Justice, when ordering pharmacy-only medicines online, sensitive data within the meaning of Article 9 GDPR is processed, as it is possible to draw conclusions about the state of health of the person placing the order. Although it is not certain whether the customers are ordering the medicine for themselves, with regard to the protected interest under Art. 9 GDPR, the ECJ considers the possibility of drawing conclusions about the customer’s state of health to be sufficient, which is why it does not matter whether the medicine is prescription-only. The online pharmacist must therefore provide information about the processing of health data and obtain appropriate consent. In the future, the following will therefore apply to those applying the law: as soon as inferences can be drawn from the existence of personal data regarding the referred to in Art. 9 data, Art. 9 GDPR is to be applied. The practical effect of the decision thus goes far beyond the area of online pharmacies. Furthermore, the ruling shows that not only data subjects or consumer associations, but also competitors can take action against competitors for breaches of privacy law. This means that the (litigation) risk for controllers is once again increasing. Data processing operations should therefore always be thoroughly checked in advance by the controller. |