Data protection breach as unfair competition: competitors may sue

Three cases, one line

A data protection breach can also be a competition law breach. If so, it may be pursued not only by supervisory authorities and the individuals affected, but also by competitors, that is companies courting the same customers, and likewise by consumer associations. That is what the Federal Court of Justice (BGH) decided on 27 March 2025 in three cases (case nos. I ZR 186/17, I ZR 222/19 and I ZR 223/19). Two concern pharmacists selling via Amazon, the third the Facebook App Center.

The question had been open for a long time. The App Center case dates back to 2012, went through three instances and twice to Luxembourg, to the European Court of Justice. Nobody is likely to be playing the games of those days any more. The answer is topical nonetheless, because it opens up the route to a cease-and-desist letter for the competition, that is a demand to refrain from a breach in future. Usually an invoice for costs comes with it.

Facebook: games in the App Center

In the Facebook App Center, users could start other providers' online games free of charge in November 2012. Below the "Play now" button there was a short notice: the application would receive the user's general information, email address, "About you" details and status updates, and was permitted to post in their name. With one game, the text ended with the sentence that the application was permitted to post "status updates, photos and more in your name".

The umbrella organisation of the consumer advice centres considered these notices inadequate and brought an action for an injunction. The Berlin Higher Regional Court (Kammergericht) ruled in its favour in 2017, and the Irish-based operator of the network appealed. The Federal Court of Justice has upheld the judgment: users were not informed comprehensibly at the outset about the nature, extent and purpose of the use of their data, nor about the legal basis and the recipients. This information is material, because with internet-based business models the consumer pays for use by giving up their data. Withholding it is unfair. The closing notice about posting in the user's name is, on top of that, an invalid standard contract term.

Pharmacies: orders via Amazon

The other two cases are set in the healthcare sector. Two pharmacists sold medicines via Amazon in 2017. When ordering, customers entered their name, the delivery address and details to individualise the medicine. The sellers did not obtain express consent to the processing of this data. In each case a competing pharmacist brought an action for an injunction, in one case additionally for damages.

The Naumburg Higher Regional Court ordered both to cease and desist in 2019. It dismissed the claimant's further complaints, for instance breaches of the Medicinal Products Act and the Pharmacy Operating Regulations, as well as the claim for damages. The Federal Court of Justice has upheld the injunction in both cases. On damages the claimant's appeal succeeded; as for the remaining provisions, the dismissal stands.

Order data is health data

For trade in medicines the decision contains a statement that reaches beyond the two cases. Name, delivery address and details of the medicine ordered are health data. That is also true where the product is available without a prescription. Health data belongs to the specially protected categories of data under the General Data Protection Regulation (GDPR). Processing such data is prohibited in principle and permitted only in exceptional cases, for instance where the customer gives express consent. Anyone handling such orders via a marketplace without obtaining that consent breaches the GDPR.

The Federal Court of Justice also explains why this concerns competition: the consent rules protect consumers' personality rights precisely in their participation in the market. Consumers should be able to decide freely whether and to what extent they give up their data in order to enter into contracts. The provision is therefore a rule of market conduct, and breaches of rules of market conduct can be pursued by a competitor under the Act against Unfair Competition.

Associations and competitors may sue

The legal question common to all three cases was whether the GDPR permits any claimants at all besides authorities and the individuals affected. The Federal Court of Justice had referred it to the European Court of Justice and answers it with yes. For consumer associations the GDPR itself provides the basis: the regulation allows Member States to grant associations a right of action without a mandate from an affected person. The association need not name an individual whose rights have been infringed. It is enough to identify a group of identifiable persons, for instance the users of the App Center, as long as the breaches are not purely hypothetical.

For competitors the answer is just as clear: the GDPR does not preclude a national rule that opens the route to the civil courts for competitors. In Germany that is standing to sue under competition law. Any competitor who is itself active on the market to a appreciable extent may bring an action.

What this means for companies

The circle of those who can attack a data protection breach has grown. A supervisory authority has to become aware of a breach and open proceedings. An affected person has to show their loss. A competitor needs neither. It is watching the market anyway and has its own interest in the other side keeping to the rules. As soon as it sees the breach, it can send a cease-and-desist letter. An association does not even have to find a specific affected person.

For online retailers this means: the data protection information before consent belongs at the start of the process, in comprehensible form. Anyone who fails to tell customers clearly what data is processed for what purpose, on what basis and to whom it goes is withholding material information. That is a competition law breach, and any competitor can send a cease-and-desist letter over it.

For pharmacies and other suppliers of medicines there is more: anyone selling via a marketplace processes health data and needs the customer's express consent for it, including for over-the-counter products. The marketplace's ordering process has to allow for that. If it does not, the breach lies with the seller, and the competitor two streets away may assert it. Anyone selling other health products should check whether the order data allows conclusions to be drawn about health.

The Federal Court of Justice decided on two breaches: withholding the data protection information before consent, and processing health data without express consent. Whether other provisions of the GDPR are also rules of market conduct, for instance the duties to erase data or to keep a record of processing activities, remains open.