Pharmaceutical Order Data III – Federal Court of Justice (BGH) on the Processing of Health Data in Pharmaceutical Sales via Amazon

The Federal Court of Justice (BGH) has decided that the distribution of pharmacy-exclusive pharmaceutical products via the 'Amazon Marketplace' platform is unlawful if customers do not provide express consent to the processing of their pharmaceutical order data as health data in the course of the ordering process.

The BGH establishes withJudgment of 27.03.2025 – I ZR 222/19that the General Data Protection Regulation (GDPR) also applies in competitive relationships as a market conduct rule within the meaning of § 3a UWG.

Key findings of the judgment:

• Data protection violation: The pharmaceutical order data collected during the ordering process on Amazon – such as name, address and ordered pharmaceutical products – constitute health data within the meaning of Art. 9 GDPR. Their processing is impermissible withoutexpress consentof the data subjects concerned.
• Responsibility of the pharmacist: Not Amazon, but the pharmacist himself places the pharmaceutical products into circulation (§ 43 AMG). Amazon is to be regarded as a 'processor' of the pharmacist in this respect (§ 8 para. 2 UWG), so that data protection violations in the course of the sales process are attributable to the pharmacist.
• Market conduct rule: Data protection requirements (in particular Art. 9 GDPR) constitute market conduct rules. A violation therefore gives rise to competition law claims for injunctive relief, disclosure and damages by competitors.
• No implied consent: Consent to data processing mustbe express. A mere purchase transaction or general terms and conditions are insufficient.
• Penalties and duty to provide information: The pharmacist was threatened with a penalty of up to EUR 250,000 in case of violation. Furthermore, he was obliged to providedisclosureregarding the scope of the unlawful orders and to providedamages compensation.

Legal assessment and recommendation:

The judgment sets clear standards for the online distribution of pharmacy-exclusive medicines – in particular with regard to data protection consent requirements. Pharmacists, mail-order distributors, platform providers and e-commerce companies in the healthcare sector face urgent need for action.

We recommend the following approach to handling pharmaceutical order data:

• Review of existing online distribution channels: Every platform solution (including Amazon, eBay, etc.) must be reviewed for compliant processing of health data.
• Implementation of effective consent mechanisms: Express customer consent to the processing of their health data must be obtained and documented before conclusion of the contract.
• Revision of platform contracts: Legal responsibility for data protection-compliant processes should be clearly regulated and, if necessary, technical measures for data collection should be adjusted.
• Keep risk management in focus: Violations may result in cease-and-desist letters from competitors, fines from data protection authorities and civil damages claims.

AVANTCORE Attorneys supportspharmacies, online retailersandplatform operators in implementing data protection-compliant distribution solutions and legally secure structuring of online business models in thehealthcare sector. Contact us for individual advice.