Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Lower Saxony: Hanover Administrative Court dismisses action brought against LfD Niedersachsen

The Administrative Court of Hanover 10th Chamber ('the Court') published, on 10 November 2021, its judgment in Case No.10 A 502/19, as issued on 9 November 2021, in which it dismissed an action brought by an unnamed company operating an online mail-order pharmacy against the Lower Saxony data protection authority ('LfD Niedersachsen'), following a decision of the same authority, issued on 8 January 2019.

Background to the case

In particular, the Court reported that the LfD Niedersachsen had instructed the plaintiff to refrain from collecting and processing customers' date of birth, unless the information was required in relation to the drug ordered, and to avoid using gender-specific salutation based on information collected during the ordering process, when the drugs ordered were not to be dosed or taken based on an individual's gender.

Moreover, the Court noted that, while the parties had unanimously declared the procedure to be closed regarding the latter matter, as the plaintiff had already inserted the option 'no information' into the order form in relation to salutations, with regard to the former matter the plaintiff had submitted that they were bound to certain obligations, including the obligation to provide age-appropriate advice. Thus, a corresponding query had to be made in the ordering process.

Findings of the Court

However, the Court found that the ordering process in question only related to products that could be purchased without a prescription, and as such, questions regarding a customer's date of birth during the ordering process should be omitted. More specifically, the Court held that the processing of the personal data in question had no legal basis under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), since the plaintiff was collecting customers' personal data without having obtained their consent.

Outcomes

Given the above, the Court dismissed the action, and noted that an application could be made to the Lower Saxony Higher Administrative Court for approval of the appeal against its judgment within one month.

You can read the press release, only available in German, here.