Referral C-21/23 (Lindenapotheke, 19 Jan 2023)

1. Do the rules in Chapter VIII of the General Data Protection Regulation preclude national rules which – alongside the powers of intervention of the supervisory authorities responsible for monitoring and enforcing the regulation and the options for legal redress for data subjects – empower competitors to bring proceedings for infringements of the General Data Protection Regulation against the infringer before the civil courts on the basis of the prohibition of unfair commercial practices?

2. Do the data that the customers of a pharmacist who acts as a seller on an online sales platform enter when ordering pharmacy-only but not prescription-only medicines on the sales platform (customer’s name, delivery address and information required for individualising the pharmacy-only medicine ordered) constitute data concerning health within the meaning of Article 9(1) GDPR and of Article 8(1) of the Data Protection Directive?