In its judgment of March 27, 2025 (Case No. I ZR 222/19), BGH addresses issues related to the sale of non-prescription, pharmacy-only medicinal products via the online platform “Amazon Marketplace” (hereinafter: Amazon).

The background to the BGH’s decision is a competition law dispute between two pharmacists. The defendant, a pharmacist holding a mail-order license, also sells his range of pharmacy-only medicines via Amazon. On Amazon, the order process is handled in such a way that, after the order data is transmitted by Amazon, the order is approved by the pharmacist. The pharmacist then packages and ships the ordered medicinal products. During the registration or purchase process, customer data is stored by Amazon. However, there is no provision for obtaining the customer’s consent to the collection, processing, and use of their order data. The plaintiff pharmacist viewed this as a violation of data protection regulations, specifically the processing of health data without the consent required under Article 9 para. 2 lit. (a) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: DSGVO).

After the Regional Court of Magdeburg initially dismissed the claim by judgment of January 18, 2019 (Case No. 36 O 48/18) due to lack of legal standing, the plaintiff prevailed in the subsequent appeal proceedings before the Higher Regional Court of Naumburg. By judgment of November 7, 2019 (Case No. 9 U 6/19), the defendant was prohibited from selling pharmacy-only medicines via the online trading platform Amazon for commercial purposes and in the context of competition, as long as it is not ensured during the registration or purchase process on this platform that the customer has given prior consent to the collection, processing, and use of their health data by the defendant.

The BGH largely followed the decision of the appellate court after the Court of Justice of the European Union (CJEU) had ruled on the BGH’s preliminary questions in this case by judgment of October 4, 2024 (Case C-21/23).

In its judgment, the BGH specifically found the following:

The sale of medicinal products via Amazon Marketplace is, in principle, compatible with the pharmacy-only requirement under Section 43 para. 1 Sentence 1 AMG

The BGH agreed with the appellate court’s view that the placing of medicinal products on the market within the meaning of Section 43 para. 1 Sentence 1 AMG was carried out by the defendant under the distribution model at issue, and not by the Amazon trading platform. Rather, the sales platform was merely used to increase the seller’s reach.

This conclusion is based on the fact that, under Section 4 para. 17 AMG, placing a medicinal product on the market requires storage or stockpiling of the product. In the case at hand, this was solely done by the defendant. It was the defendant who approved the order, packaged the medicinal products, and shipped them. In doing so, he delivered the products to the customers and transferred control over them. The sales situation, following the transmission of the order data by Amazon to the pharmacist, was therefore comparable to a direct order placed with an online pharmacy.

According to the BGH, the question of who places the medicinal products on the market is not affected by whether the advertising measures carried out by Amazon can be attributed to the defendant, nor by whether Amazon’s role goes beyond that of a mere intermediary.

The BGH further stated that a pharmacist holding the required mail-order license is free to involve logistics companies in the distribution process or to cooperate with drugstores whose branches serve as pickup points. The only requirement is that these companies must not act in a way that suggests they are themselves engaged in the trade of medicinal products. Accordingly, distribution via Amazon is also compatible with the pharmacy-only requirement, provided that the dispensing of the medicinal products is carried out solely by the defendant.

Processing of special categories of personal data within the meaning of Article 9 para. 1 DSGVO

Like the appellate court, the BGH also considers the sale of pharmacy-only medicinal products via Amazon to constitute the processing of health data within the meaning of Article 9 para. 1 DSGVO. Such data processing is inadmissible without the explicit consent required under Article 9 para. 2 lit. (a) DSGVO.

The legal classification of the order data as health data within the meaning of Article 9 para. 1 DSGVO is in line with the case law of the CJEU. In response to the BGH’s request for a preliminary ruling, the CJEU held that the data customers are required to provide when ordering pharmacy-only medicinal products constitutes health data within the meaning of Article 9 para. 1 DSGVO. This includes the customer’s name, delivery address, and other information necessary to individualize the ordered pharmacy-only medicinal product.

The entry of order data by customers and the subsequent use of this data to fulfill the order constitutes processing within the meaning of Article 4 para. 2 DSGVO. Due to the classification of this data as health data, and in the absence of any applicable legal basis, this results in a violation of the processing prohibition under Article 9 para. 1 DSGVO. In the case at hand, no explicit consent was provided during the ordering process, meaning that the explicit consent required under Article 9 para. 2 lit. (a) DSGVO for one or more specific purposes was lacking.

According to the BGH, implied consent is not sufficient in this context. Moreover, the mere act of ordering a medicinal product on Amazon cannot be interpreted as consent to the processing of health-related data.

The BGH places the responsibility under competition law for the unlawful data processing on the defendant. Within the defendant’s structured distribution system, Amazon acts as its agent. As such, the data protection-relevant actions taken by Amazon within its immediate sphere of influence are to be attributed to the defendant as if they were his own.

Data protection requirements for the processing of health data constitute market conduct rules within the meaning of Section 3a of the German Unfair Competition Act (UWG).

According to both the BGH and the appellate court, the requirements imposed by the DSGVO on the processing of health data are to be regarded as market conduct rules within the meaning of Section 3a UWG. A violation of these provisions is also likely to significantly impair the interests of consumers within the meaning of Section 3a UWG. Accordingly, competitors are to be entitled under Section 8 para. 3 No. 1 UWG to assert competition law claims through legal action. This view contrasts with that of the Regional Court of Magdeburg at first instance.

The BGH’s position reflects the case law of the CJEU, which clarified in its judgment of October 4, 2024, that the provisions contained in Chapter VIII of the DSGVO regarding the enforcement of data protection rules are not exhaustive. These do not preclude national legal provisions, such as German law, that grant a competitor the right to bring an action against an infringer for breaches of data protection regulations under the DSGVO.

Important

The BGH explicitly does not oppose the general possibility of selling pharmacy-only medicinal products via online platforms such as Amazon, provided that the dispensing of the medicinal products is carried out solely by the pharmacist in an institutional capacity. However, if such a distribution channel is chosen, the specific requirements applicable to pharmacy-only medicinal products must be observed. This includes, on the one hand, the fundamental requirement of holding a pharmacy and mail-order license, and on the other hand, compliance with data protection requirements for health data. In particular, this means that the customer’s explicit consent must be obtained for the processing of their health data for one or more specifically defined purposes.