The Personal Data Protection Office Chairman Intervenes in Case Involving Personal Data in Pharmacy Systems

In a case under investigation by the Office of Competition and Consumer Protection (UOKiK), Mirosław Wróblewski, President of the Personal Data Protection Office (UODO), requested the cooperation of the Chief Pharmaceutical Inspector to determine how the identified practice affected patients’ personal data.

According to media reports on the antitrust proceedings that culminated in the Office of Competition and Consumer Protection decision, the mechanism for exchanging information between pharmacies and wholesalers (including Neuca, Farmacol, and PGF) was based on the use of affiliate programs and so-called “add-ons” integrated with pharmacy IT systems.

The software was used by pharmacies to automatically report data on pharmaceutical product sales to wholesalers.

However, pharmacy systems process patients’ personal data, including, among other things, data whose disclosure poses significant risks (e.g., the PESEL number) as well as health-related data. It is unclear whether this data was transferred to the data warehouse. Therefore, the President of UODO Mirosław Wróblewski asks Chief Pharmaceutical Inspector Łukasz Pietrzak:

1.     Has the GIF already investigated the scope of data collected—the so-called “overlay”—by pharmaceutical wholesalers from pharmacy systems?

2.     Is the GIF aware of any instances where personal data was transferred by reporting systems that are the subject of proceedings conducted by the Office of Competition and Consumer Protection (UOKIK)?

3.     Or is the GIF only planning such inspections?

Given the scale of the issue (according to the Office of Competition and Consumer Protection, the wholesalers in question held over 70 percent of the market share, and a total of over 4,000 pharmacies—representing nearly 40 percent of the market—use affiliate programs), the matter may pose a risk of a systemic breach of the privacy of millions of patients.

The President of the Personal Data Protection Office requests that this matter be treated as urgent.

DKN.5101.480.2026