When are personal data health data? EU Court of Justice rules

On 4 October 2024, the Court of Justice delivered an important and very surprising ruling. The case concerned the question of whether placing an order with an online pharmacy constitutes the processing of special categories of personal data within the meaning of the General Data Protection Regulation (“GDPR”) or not.

The Court of Justice ruled that in this case there was indeed processing of personal data concerning health, even if the order at the online pharmacy was not intended for the person who placed the order. The Court of Justice deviated from the advice of the Advocate General at the Court of Justice in this ruling.

Court of Justice of the EU 4 October 2024 , C- 21/23, ECLI:EU:C:2024:846 ( Lindenapotheke )

The article below explains the judgment of the Court of Justice.

Why is it important whether a piece of data is personal data?

The question of whether a particular piece of data is personal data within the meaning of the GDPR has very major legal consequences. In information law, information is in principle 'free', unless there is a specific law that imposes certain rights or obligations with respect to certain information.

The General Data Protection Regulation, also known as 'the privacy law', is a famous example of a law that contains specific obligations regarding information, namely personal data. If certain data is not personal data, the GDPR and the legal obligations from the GDPR do not apply. If a data is personal data, the processing of that personal data must generally comply with the processing principles and specific rules in the GDPR.

How do I know if a piece of data is personal data?

The GDPR defines personal data as follows:

“Article 4 under 1 GDPR
Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;”

The answer to the question of whether a particular piece of data is personal data is very context-sensitive. For example, it is quite possible that a particular piece of data is not sufficient in itself to identify a natural person without too much effort, but that a particular piece of data can be used 'in combination' with other data to identify a natural person. This means that it is still personal data within the meaning of the GDPR, even if it does not appear to be privacy-sensitive information at first glance. Which means that the rules of the GDPR apply to the processing of that information.

The EU Court of Justice previously also ruled that facts and circumstances surrounding a particular company or organisation may be relevant. In the sense that a particular piece of data that is not personal data for most companies and organisations may be personal data for a specific party, for example because that specific party has access to certain other data through a unique role, which that party can combine to identify natural persons. This applied , for example, to the "VIN number" ( vehicle identification number ). Most companies and organizations cannot make much of such a number, but a car company may have access to other data that can be combined with the VIN number to identify a natural person, such as the owner of the car with that VIN number:

Court of Justice of the EU 9 November 2023, C-319/22, ECLI:EU:C:2023:837 ( General context Autoteile -Handel (Access to vehicle information) )

Why is it important whether a personal data is health data?

The GDPR roughly has two regimes, one for 'regular' personal data and a stricter regime for the so-called “special categories of personal data”.

The special categories of personal data are, exhaustively, the following: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health and data concerning sex life or sexual orientation.

The processing of personal data is in principle permitted, provided that the processing principles and rules of the GDPR are observed. The processing of special categories of personal data is in principle prohibited , unless an exception to the prohibition applies in a specific situation.

“Article 9 paragraph 1 GDPR
Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.”

The exceptions to the prohibition are limited. If no exception applies, but special categories of personal data are processed, this is a very serious violation of the GDPR, which is punishable by high fines and/or liability claims.

How do I know if a personal data is health data ?

The Lindenapotheke case involved customers of an online pharmacy in Germany. Via the online pharmacy, one could order medicines, among other things. The online pharmacy did not ask for explicit consent to process health data. The explicit consent of the data subject (= natural person to whom the personal data relates) is one of the exceptions to the prohibition on processing special categories of personal data.

The main argument why there would be no processing of special categories of personal data, with regard to health, was that an order does not show that certain medicines or other medical devices are intended for the person placing the order. After all, a healthcare institution, or a patient 's relative, can also place the order for someone else. Therefore, no information with regard to health could be derived from the order. The name and delivery address of the person placing the order are not special personal data, but regular personal data that do not fall under the stricter regime. The Advocate General at the Court of Justice advised not to consider customer data from online pharmacists as health data.

However, the Court of Justice of the EU went the other way and did not follow the advice of the Advocate General. The Court of Justice of the EU ruled that a broad definition of what constitutes health data applies, also because a high level of protection is required for this type of data. Even if the order is placed for someone else, the risk remains that conclusions can be drawn about the state of health of a natural person and a high level of protection is required.

Response to the ruling

Critics point out that this ruling will result in an increasing need for explicit consent in the healthcare context, thereby increasing the administrative burden, without patients necessarily benefiting from more consent forms.

Proponents welcome the confirmation by the Court of Justice that a high level of protection applies in law within the health context and that a high level of protection is guaranteed. In a special privacy context that is as highly sensitive as health, according to the proponents this is appropriate.

In practice, almost only informed explicit consent is sufficient to make the processing of personal data concerning health lawful. Anyone who works with health data is therefore well advised to check whether this is permitted and if not, either to ask for explicit consent or to stop the possibly prohibited processing.

Questions?

Are you wondering what this ruling means for you or your organization? Do you have questions in the field of privacy or data protection law? Do you have questions about the do's and don'ts of processing special categories of personal data, such as health data? Contact our IT & privacy lawyers today . They will be happy to assist you.

Approach us for legal advice today!

Do you want to use our knowledge and call us with some regularity? Subscribe to the Virtual Legal Department. 

Interested? Call or email us:

T. +31(0)70-3819281
E. info@wisemen.nl

For the latest information, subscribe to the newsletter now

WiseMen Newsletter!