In a ruling dated 23.01.2024, the Higher Administrative Court of Lower Saxony dealt with the legality of a data protection order prohibiting an online pharmacy from always requesting the date of birth as mandatory information in the ordering process.
The plaintiff operator of an online mail-order pharmacy demanded, among other things, the mandatory indication of the date of birth in its online order forms. In a decision dated 8 January 2019, the defendant instructed the plaintiff, among other things, to refrain from requesting the date of birth and title of the customer, regardless of the type of medication ordered.
In its ruling of November 9, 2021, the Hanover Administrative Court dismissed the action on the grounds that the order was lawful, as the collection and processing of the date of birth, regardless of which product was ordered, violated the principle of lawfulness under Art. 5 para. 1 lit. a GDPR and was not lawful under Art. 6 para. 1 GDPR.
Who takes the medicine?
In particular, the Administrative Court of Hanover did not follow the plaintiff's argument that the query of the date of birth pursuant to Art. 6 para. 1 lit. b) GDPR was necessary for the implementation of pre-contractual measures. Contrary to the plaintiff's argument, a simple query of the age of majority is sufficient to verify legal capacity; no specific date of birth is required for this. The argument that this was intended to enable age-appropriate advice did not hold water either. On the other hand, the court stated that the age of the person for whom the product was intended for use or ingestion, who did not have to be the same person as the customer , would then have to be asked. The fact that the plaintiff offered products that could be consumed regardless of age also argued against the need to state the date of birth.
No legal obligation to query
The fulfillment of a legal obligation pursuant to Art. 6 para. 1 sentence 1 lit. c) GDPR also does not justify the query of the date of birth, since such an obligation did not exist in the present case under the German Medicinal Products Prescription Ordinance, as the plaintiff only offered the online order for over-the-counter products.
A balancing of interests pursuant to Art. 6 para. 1 lit. f) GDPR did not have to be carried out either, as the query of the age of majority was a more efficient means and the query of the exact date of birth was therefore not necessary.
The plaintiff appealed against this decision of the Hanover Administrative Court.
The OVG Lower Saxony comprehensively endorsed the decision of the Administrative Court of Hanover, meaning that the appeal was not to be allowed due to serious doubts regarding the correctness of the contested decision pursuant to Section 124 (2) No. 1 VwGO. The OVG Lower Saxony also denied the fundamental importance of the case within the meaning of Section 124 (2) No. 3 VwGO, so that the appeal was not to be allowed.
In summary, it can be said that this decision is not surprising. Rather, the principle of data minimization, which states that only data that is appropriate and necessary for the purpose of the processing is to be collected and used, is a fundamental principle of the GDPR, which is again applied here. The decision of the OVG Lower Saxony again confirms that only the personal data that is really necessary may be processed. Additional, unnecessary personal data may not be collected.
