GDPR as a Tool for Unfair Competition: Professional Standing in Privacy Litigation

1. The facts

   The case marking this pivotal shift involves an online pharmacy operating on a major global e-commerce platform. According to Guida al Diritto, a competitor sued the rival business, alleging that it sold medicinal products without properly collecting explicit consent for processing customers' health data. The plaintiff was not acting to protect consumer privacy, but rather to challenge an act of unfair competition.

   The plaintiff argued that by circumventing the complex technical and disclosure requirements under the GDPR, the rival pharmacy achieved a streamlined and less costly purchasing process, thereby distorting market competition. The dispute, initially brought before German courts, reached the Court of Justice of the European Union to determine whether the GDPR constitutes an exhaustive system of remedies or permits civil claims by third-party competitors. The procedural stage culminated in a preliminary ruling by the Court of Justice affirming the compatibility of such civil actions with EU law.

2. 

   The legal framework

   The applicable legal framework intersects national civil law and European regulations.

   1. Article 2598, point 3, of the Italian Civil Code governs the general clause of unfair competition, prohibiting the use of means inconsistent with professional fairness and capable of harming another's business.
   2. EU Regulation 2016/679 (GDPR) sets forth data protection duties, the breach of which is here characterized as a violation of public law rules aimed at cost savings.
   3. Article 2600 of the Civil Code governs civil remedies, providing for injunctive relief and damages upon proof of the competitive tort.

3. Case law orientation

   Supranational jurisprudence has clarified that the GDPR does not exhaust the remedies available in cases of unlawful processing. The European Court ruled that the GDPR does not preclude national legislation from granting competitors standing to sue entities violating privacy rules. It was noted that competitor enforcement reinforces the overall effectiveness of European law, safeguarding the effet utile of the Regulation.

   At the domestic level, lower court jurisprudence has consistently held that non-compliance with administrative or safety regulations, where it yields cost savings for the infringer, constitutes unfair competition via violation of public law rules. However, settled case law requires that the infringed rule directly affects the exercise of economic activity or that its non-observance alters fair competition among market players.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Privacy compliance must also be viewed as a defense strategy in civil litigation with competitors, rather than solely a risk management measure against administrative fines.
   2. Undertakings can leverage unfair competition actions to challenge irregular practices by competitors operating in the digital market through unlawful procedural shortcuts.
   3. Establishing the competitive advantage gained from compliance cost savings is the central evidentiary prerequisite for a successful damages claim.
   4. Strategic coordination between complaints before the Data Protection Authority and proceedings before civil courts is recommended to maximize the effectiveness of legal remedies.

References: Art. 2598 c.c.Regolamento UE 2016/679Art. 2600 c.c.

Editorial oversight: Avv. Federico Papa·ICAMUpdated 18 October 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction