Op-Ed: “Breaches of the GDPR as an unfair commercial Practice and a new Assessment Standard for inferred special Category personal Data: Lindenapotheke (C‑21/23)”

Unfair commercial practices

The General Data Protection Regulation (GDPR) aims to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.

The Regulation applies to the processing of personal data by controllers and processors in the Union, regardless of whether the processing takes place in the Union or not.

According to the GDPR, the processing of personal data must be lawful, fair and transparent.

The GDPR further prohibits the processing of special categories of personal data, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, unless one of the exceptions set out in Article 9 GDPR applies.

Inferred special categories of personal data

In the case of Lindenapotheke (C‑21/23), the Court of Justice of the European Union (CJEU) had to decide whether the processing of inferred special categories of personal data, such as data revealing health data, without the data subject's consent constitutes an unfair commercial practice within the meaning of Directive 2005/29/EC.

The CJEU held that the processing of such data without consent does constitute an unfair commercial practice, as it is contrary to the requirements of good faith and fair dealing and it is likely to cause substantial harm to the data subject.

The CJEU also established a new assessment standard for determining whether inferred special categories of personal data have been processed.

According to the CJEU, the assessment must take into account all the circumstances of the case, including the nature of the data, the context in which it was processed, the purposes of the processing, and the potential consequences of the processing for the data subject.

Conclusion

New assessment standard

The CJEU's judgment in Lindenapotheke (C‑21/23) is a significant development in the field of data protection.

The judgment clarifies that the processing of inferred special categories of personal data without consent constitutes an unfair commercial practice and establishes a new assessment standard for determining whether such data have been processed.

Implications for businesses

The judgment has important implications for businesses that process personal data.

Businesses must now take steps to ensure that they have a lawful basis for processing special categories of personal data, including inferred data.

Businesses must also be aware of the new assessment standard established by the CJEU and take this into account when processing personal data.