Home / Legal Publications / Imminent decision on the legal standing of competitors...

Imminent decision on the legal standing of competitors in the case of data protection violations

NewsMonitor | Data protection – Episode 6

Published on 2 February 2023

In orders dated 12 January 2023, the German Federal Court of Justice asked the European Court of Justice to rule on the question of whether a breach of the General Data Protection Regulation (GDPR) can be pursued with an action under competition law before the civil courts.

The question of whether infringements of the GDPR can be taken up by competitors with an action under competition law ("private enforcement") is the subject of lively discussion in the jurisprudential literature and has been the subject of several German court decisions. Most recently, a majority in favour of the legal opinion affirming the right of competitors to sue has emerged in German case law.

This contrasts with the Austrian Supreme Court, which, in its only and much criticised decision on this topic to date, denied the legal standing of competitors to sue for violations of the GDPR on the basis of the alleged "supreme personality" of data protection law.

The European Court of Justice’s decision will now clarify this question and thus provide legal certainty—something to be welcomed. So far, the European Court of Justice has not ruled on this question.

We expect that the European Court of Justice will affirm the right of competitors to take legal action under competition law in the event of data protection violations. Companies should therefore immediately start checking their data protection documents, such as processing directories, data protection declarations, consent declarations, etc., with regard to data protection compliance and make any necessary adjustments.

Companies operating in the health sector will be interested to know that the case concerned the processing of data of purchasers of non-prescription medicines. In this context, the German Federal Court of Justice raised a second question with the European Court of Justice, namely whether customer information (name, delivery address, etc.) is health data within the meaning of Art 9 (1) of the GDPR. If this were the case, it could only be processed with the express consent of the customer.

Authors: Johannes Scharf, Gabriela Staber

Press release no. 6/23 of 12.1.2023 of the BGH OGH 4 Ob 84/19k
 

Key contact

Gabriela Staber
Partner
Vienna
T +43 1 40443 4850

NewsMonitor

Are you interested in the latest developments in data privacy and employment law? The CMS NewsMonitor explains everything you need to know in a nutshell. Here you will find the episodes that have already been published: