CJEU confirms that competitors can sue for breaches of the GDPR (using local competition rules)

The Court of Justice of the European Union (CJEU) recently confirmed that a competitor, who is not a ‘data subject’ under the GDPR, has standing to bring an action before the courts of Member States for enforcement of the GDPR on the basis of national competition rules. 

Background 

The case (C-21/23) centres around a pharmacy owner in Germany operating under the trade name Lindenapotheke, who marketed pharmacy-only medicinal products on Amazon. When ordering such products, customers had to enter their personal data.  

A competitor brought an action before the German courts seeking an order for the Lindenapotheke operator to cease marketing pharmacy-only medicinal products on Amazon for so long as there was no guarantee that customers were able to give their prior consent to their health data being processed. The claimant argued that the defendant’s behaviour constituted an unfair commercial practice under the German Law against Unfair Competition, which provides that anyone infringing a statutory provision aimed at regulating market conduct will act unfairly where their infringement is capable of having an appreciable adverse effect on consumers, other market players or competitors (paragraph 3(a)). German national rules also provide that competitors can bring actions for an injunction to prevent such infringements.   

The case was appealed to the German Federal Court of Justice, which made a referral to the CJEU. 

CJEU ruling 

The CJEU held that such legislation is consistent with the GDPR, which does not preclude national legislation allowing competitors to bring legal proceedings against a GDPR infringer for unfair commercial practices.  

The CJEU explained that the GDPR does not introduce “an exhaustive harmonisation” of remedies for GDPR enforcement which would rule out Member State laws which facilitate actions by competitors. The CJEU accepted that a competitor bringing an application for injunctive relief related to GDPR infringement will not necessarily be motivated by data protection concerns but rather to ensure fair competition, including to protect its own interests. This makes sense against the competition landscape described by the CJEU, where access to personal data and the ability to process such data “have become a significant parameter of competition between undertakings in the digital economy”. 

Pragmatically speaking, the CJEU considered that such applications by competitors will contribute to overall compliance with the GDPR and the strengthening of data subjects’ rights. Indeed, the CJEU opined that an application brought by a competitor may prove to be “particularly effective” in safeguarding data protection by preventing a large number of infringements. 

Competition / data protection overlap: an emerging theme 

The CJEU has already confirmed (in Meta v Bundeskartellamt) that Member State competition authorities can assess compliance with data protection rules when investigating an alleged abuse of dominance under competition rules. This was acknowledged by the CJEU in the Lindenapotheke case which noted that “to ensure fair competition, it may be necessary to take into account the rules on the protection of personal data in the context of the application of competition law and the rules on unfair commercial practices”. This latest development provides a further example of how the enforcement of data protection and competition law may not always be distinct even in the case of enforcement by a competitor.     

Following Brexit, the UK is not bound by the CJEU’s recent decision, and in any event, the UK competition rules do not provide the same legislative basis for such an action. That said, we do see substantial cross-over between the approach to data protection and competition law in the UK with the authorities working closely together to ensure consistent enforcement across the board. It remains to be seen whether this will extend to actions brought by competitors either under UK competition law or under the new digital markets competition regime (see our spotlight series on this topic here).