Data protection for sensitive data: Pharmacist may not sell drugs via Amazon

An important and very far-reaching ruling on data protection has already been reached before the entry into force of the basic European Data Protection Regulation: A few weeks ago, the German District Court of Dessau-Roßlau prohibited a pharmacist from selling pharmacy-only medicines via the Amazon trading platform.

Another pharmacist had filed a lawsuit against the defendant pharmacist who sold pharmacy-only medicines on Amazon. The plaintiff argued that the sales activity was a violation of the Federal Data Protection Act (BDSG, old version) and at the same time also a violation of fairness law.

Special consent required for handling sensitive data

The LG Dessau-Roßlau ruled in favour of the plaintiff (LG Dessau-Roßlau, March 2018, Az. 3 O 29/17). Because the defendant pharmacist had not requested any special consent from the customers in the purchase process for the handling of their health-related data.

However, since the defendant pharmacist sold drugs via the sales platform, he infringed § 4 and § 4a, 28 paragraph 7 BDSG. The fact that these were pharmacy-only medicines did not play any role in the present case. Because all health data are considered sensitive data (§ 3 Abs. 9, BDSG) and also the regional court evaluated the contentious data in such a way.

The handling of health data is – unless the special requirements of & 28 para. 6 or para. 7 BDSG are met – according to § 4a para. 3 BDSG (old version) only permitted with special consent. The basic consent of customers to the collection, storage and processing of their data through the establishment of a customer account on Amazon, as is customary practice, cannot, in the opinion of the court, be equated with an express consent to the collection and further processing of health data. Because ordering the medicines allowed conclusions to be drawn about possible diseases and the health of the customers ordering from Amazon.

Furthermore, the court found that the exceptional circumstances of § 28 Paragraph 7 BDSG did not apply, according to which sensitive data may also be processed without express consent for the purpose of health care, since in the present case the necessary medical confidentiality and secrecy obligation is missing. Not the defendant, who fulfils this obligation as a pharmacist, but the Amazon sales platform has no special consent from customers.

The accused pharmacist relied on this: the customer selects the respective medicine and its supplier on Amazon, whereupon the desired pharmacy receives the data of the buyer for the completion of the sales contract and the supply from the platform. Only the relevant order data and therefore not sensitive data was forwarded to him. The online trading platform just was the intermediary.

Distribution via Amazon makes data commercially usable like goods

In addition, the court has considered a commercial use of the Customer data. The data collected would be used and stored as an economic good like a product as a result of the distribution of the drugs via Amazon, so they could also be used for advertising or other commercial purposes. Therefore a market relevance is given and an application of the fairness law is necessary. In this case, violations of §§ 4, 4a, 28 BDSG are subject to the right of fairness.

However, the Regional Court also emphasises that the provisions and regulations of the Pharmacy Act and the Pharmacy Management Regulations also apply to the defendant. This is not only a market access regulation, but also a market conduct regulation, so that § 3 a UWG applies directly.

This decision is explosive: the application of § 3 a UWG implies that every competitor has the right to sue as soon as he would discover an infringement of a product on an online trading platform such as Amazon that may be associated with sensitive data.

Sensitive data are defined by EU regulations

The European General Data Protection Regulation (GDPR) in force since 25 May 2018 also specifies high requirements for the processing of sensitive data (Art. 9 Para. 1, GDPR). This concerns much more than just the customer data of pharmacies. The list of processing rules and the definition of sensitive data follow the provisions of the EC Data Protection Directive, which has been in force since 1995 (Directive 95/46/EC of the European Parliament).

Article 8.1 describes sensitive data:
“Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life”

Affected – and excluded from a sale via the Amazon online platform – are therefore also, for example, medical supply stores and spectacle manufacturers as well as manufacturers of sexual enhancers or condoms.

The GDPR also adds the processing of genetic data and biometric data for the unique identification of a natural person to the list of sensitive data. The District Court of Dessau-Roßlau has made an important and far-reaching ruling on data protection in this area of law.