Processing personal health data in the context of the European online pharmacy market: lawful bases under the GDPR and Swedish law.

Abstract

Over the past three years, the European online pharmacy market has grown significantly and is expected to continue to grow at a rapid pace. One of the key factors that may further catalyse this growth is the personal health data that online pharmacies can collect.  If online pharmacies use these data lawfully and with the public interest in mind, this may provide the opportunity to positively transform not only the online pharmacy market but also the entire healthcare industry. In order to maximise the benefits of these personal health data for improving public health but at the same time protect European citizens’ privacy, further analysis of the data protection laws and their applicability in the context of the online pharmacy market is necessary. Currently, there still lacks clarity, for example, regarding the lawful bases under the GDPR for processing personal health data for scientific research purposes. Therefore, this article identifies the main purposes for which online pharmacies may choose to process personal health data and which lawful bases under the GDPR may be suitable to address them. This article will additionally address Swedish law in order to provide an example of the interaction between national laws and the GDPR when processing personal health data in the online pharmacy market.