Can Undertakings Bring Proceedings Against Competitors Before Civil Courts for Breach of the GDPR?

The Subject Matter of the Case and Questions Referred to the CJEU

ND is an undertaking operating a pharmacy under the trade name “Lindenapotheke” and has been selling pharmacy-only medicinal products through the Amazon Marketplace platform since 2017. As part of the online ordering process of these medicinal products, ND’s customers must provide ND with their names, delivery addresses, and certain personal data required for the personalization of the products.

DR, who operates another pharmacy, brought an action alleging that the sale by ND of pharmacy-only medicinal products through Amazon Marketplace constituted an unfair commercial practice on the grounds that it failed to comply with the legal requirements for obtaining the customer’s consent required by the legislation on the protection of personal data.

On 28.03.2018, the Regional Court of Dessau-Roßlau upheld the action. ND appealed against this decision to the Higher Regional Court of Naumburg, which rejected the appeal in a decision dated 07.11.2019. The appeal court held that the processing of data concerning health without the explicit consent of the customers is prohibited under Article 9 of the GDPR. Additionally, the court stated that the relevant GDPR regulation is in the nature of legal provisions to regulate market conduct within the meaning of the German Unfair Competition Act. Finally, the court stated that, under the German Unfair Competition Act, DR, as a competitor, is entitled to bring an action in the civil courts alleging that ND has breached these regulations.

ND filed an objection against the said decision before the Referring Court. The Referring Court posed two questions to the CJEU concerning the dispute. For the purposes of this article, only the first question of the Referring Court is addressed.

In its first question, the Referring Court asked whether Chapter 8 of the GDPR allows national law to grant competitors of an undertaking the right to bring proceedings before civil courts on the grounds that the undertaking has infringed the provisions of the GDPR, based on national regulations on unfair commercial practices.

The Referring Court noted that Chapter 8 of the GDPR does not mention, but also does not expressly exclude, the possibility that competing undertakings may bring proceedings under unfair commercial practices for infringements of data protection legislation. Likewise, the phrase “without prejudice to other …” used in Articles 77, 78, and 79 of the GDPR may indicate that judicial remedies are not limited to those foreseen under these provisions. On the other hand, the Referring Court expressed its concern that such an understanding may contravene the GDPR’s objectives of harmonization of national legislation and, in particular, the uniform application of monitoring practices across the Member States of the European Union.

However, in the Referring Court’s view, the right of competitors to bring an action for infringement of the GDPR may also be considered as an additional means of monitoring the application of the GDPR, in line with the principle of effectiveness (effet utile), which aims to ensure the maximum possible protection of personal data in accordance with Article 10 of the GDPR.

Considerations of the CJEU

As mentioned above, Chapter 8 of the GDPR provides for legal remedies to protect the rights of data subjects. As a rule, these remedies can be invoked either directly by the data subjects pursuant to Articles 77-79 of the GDPR or by a not-for-profit body, organization, or association, subject to certain conditions pursuant to Article 80. In the present case, DR, which is not a data subject within the meaning of Article 4 of the GDPR and not an authorized body or entity within the meaning of Article 80, brought an action before a civil court on the grounds that its competitor ND had engaged in unfair commercial practices by breaching the GDPR. 

In its assessment of the case, the CJEU first stated that when interpreting a provision of the GDPR, not only the wording but also the context of the provision and the purpose of the GDPR must be considered. Moreover, it emphasized that the wording of the provisions of Chapter 8 of the GDPR does not expressly exclude the possibility for a competitor of an undertaking to bring proceedings before a civil court on the grounds that that undertaking has engaged in unfair commercial practices in breach of the provisions of the GDPR. 

Furthermore, the CJEU highlighted that infringement of the provisions of the GDPR, while primarily affecting the data subjects, may also adversely affect third parties. It also emphasized that a breach of a regulation on the protection of personal data may also lead to a breach of rules on consumer protection or unfair commercial practices at the same time.

In this context, the CJEU recalled that access to and use of personal data is of great importance in the context of the digital economy. Indeed, access to and the ability to process personal data have become important parameters of competition between undertakings in the digital economy. Therefore, the CJEU underlined that rules on the protection of personal data and unfair commercial practices may also need to be considered to ensure fair competition conditions.

Moreover, the CJEU noted that certain provisions of the GDPR, including Article 80 GDPR, provide Member States with a margin of discretion as to the manner in which the provisions of the GDPR are applied, allowing Member States to lay down additional, stricter, or derogating national rules. In addition, the CJEU emphasized that the GDPR’s aim to ensure a high and consistent level of protection for the processing of personal data and to harmonize Member States’ legislation is not intended to limit legal remedies in Member States. The CJEU also asserted that allowing a competitor to bring proceedings based on GDPR violations within the framework of national regulations on unfair commercial practices serves the GDPR’s objective of ensuring the highest possible level of protection for data subjects. In other words, enabling such proceedings does not undermine the GDPR framework but rather reinforces it. Indeed, such a possibility for competitors may prevent a significant number of infringements.

In light of all these considerations, the CJEU concluded that the provisions of Chapter 8 of the GDPR must be interpreted as not precluding national legislation that gives competitors the right to bring proceedings before civil courts against alleged infringers of the GDPR.

Conclusion

In the Lindenapotheke Decision, the CJEU examined whether Chapter 8 of the GDPR should be interpreted in a way that excludes national legislation that gives competitors of alleged infringers of personal data protection regulations the right to bring proceedings in civil courts on the grounds that such infringements constitute unfair commercial practices. In its assessments, the CJEU considered the wording and the purpose of the relevant section together. In this context, the CJEU underlined that the wording of the provisions in Chapter 8 does not expressly exclude the possibility for a competitor of an undertaking to bring proceedings before a civil court on the grounds that that undertaking has engaged in unfair commercial practices in breach of the provisions of the GDPR. Furthermore, the CJEU considered that allowing a competitor to bring such proceedings under national competition law or national rules on unfair commercial practices supports the GDPR’s overarching objective of protecting data subjects. In this context, the CJEU clarified that, where national law allows, an undertaking may bring proceedings against a competitor for unfair commercial practices based on alleged violations of the GDPR.