From Data Access to GDPR Abuse? The CJEU Draws the Line in Brillen Rottler

The CJEU has ruled in Brillen Rottler (C-526/24), an important case on the GDPR right of access and the limits of Article 12(5) GDPR. The judgment addresses two relevant and practical questions on data subject requests. The first question is: can a (first) access request be refused as “manifestly unfounded or excessive” on the basis of Article 12 (5) GDPR where the data subject appears to be using the GDPR strategically, including to prepare a damages claim? The second question in this regard is whether a controller can rely on public information demonstrating that that data subject has submitted a large number of requests for access and compensation to other controllers. 

The conclusion of the CJEU can be summarized as follows: The data subject’s intention is abusive if the purpose is another than becoming aware of the processing of its data and verifying the lawfulness thereof, in order to be able, subsequently, to obtain protection of his or her rights under the GDPR. Such abusive intention can cause the access request to qualify as excessive, even if it’s a first request for that controller. Nevertheless, any limitation of an access request must remain exceptional. 

The Court’s answer on possible excessiveness of first requests 

The core of the judgment is that a first access request is not immune from scrutiny, but refusing it on abuse grounds is possible only in specific and exceptional circumstances. 

1. First, the Court clarified that excessive has a broader meaning than only referring to the possibly repetitive character of data subject requests. The element of repetitiveness is made explicit solely as an example. But, considering case law and the regular meaning of the word: excessiveness is understood as something which exceeds the ordinary or reasonable amount or which exceeds the desirable or permissible amount. So, qualifying a first request by that data subject vis-à-vis that controller as excessive is not ruled out. 

2. Second, the Court held that the right of access remains a fundamental GDPR right but that its intended purpose, as well as that of other data subject requests is clear. The CJEU refers to the general principle that EU law cannot be relied on for abusive or fraudulent ends (by analogy to case law analysing article 57(4) GDPR, see judgment 9 January 2025, Östereichische Datenshcutzbehörde, C-416/23). Consequently, a clear intention to seek compensation can be enough to argue an abusive intention on the part of the data subject, and therefore the excessive character of that data subject request under article 12(5) GDPR, regardless of quantitative elements. 

   So, if a data subject has an abusive intention when exercising its GDPR rights, the first request may be refused by the controller on those grounds (art. 12(5) GDPR). Such abusive intention can be identified after considering all circumstances, including among others publicly available information if supported by other relevant material. The Court clarifies that such abusive intention is present from the moment that the data subject makes a “request for a purpose other than that of being aware of the processing of those data and verifying the lawfulness of that processing, in order to be able, subsequently, to obtain protection of his or her rights under the GDPR” (para. 40 of the decisions). 

   That is probably the most important operational takeaway from the case. Of course, if the data subject is clearly in the right and did suffer damages caused by the infringing controller, it should not lose protection under Article 15 GDPR merely because they are also considering an Article 82 claim. However, where it is clear that the data subject made a request to exercise a certain GDPR-related right with a different intention than that of the Regulation, abuse may be present. Such abusive intention can then be sufficient to argue the excessive character of the data access request. The Court does still state that the concept of ‘excessive requests’ must be interpreted restrictively, and a controller may only rely on this in exceptional circumstances. The controller bears the burden of demonstrating the excessive nature, and can do so by demonstrating that the data subject has made an access request not for the purpose of being aware of the processing, but for the purpose of artificially creating the conditions laid down for obtaining compensation from that controller. 

The Court’s answer on relying on publicly available information 

It must be clarified that the Court however reject a broad reliance on public information about the requester, as a sole ground for refusal by the controller. Publicly available material indicating that the data subject has made many access requests or compensation claims elsewhere may, by itself, not be sufficient to classify the request as excessive or abusive. The Court was clearly concerned that a lower threshold would invite controllers to weaponize “abuse” as a routine defence against access requests. The Court however did note that such information may be taken into account, but should be supported by other relevant material. 

The right to seek compensation for data subjects under Article 82 GDPR 

The referral also raised questions on the relationship between access requests and compensation. The broader issue was whether compensation under Article 82 GDPR is confined to damage caused by unlawful “processing” in the strict sense, or whether other GDPR infringements may also in principle support a claim. To summarise: 

• An infringement of the GDPR that does not involve processing of personal data in the strict sense can also lead to compensation under Article 82 GDPR. 
• An infringement of the GDPR does however not automatically trigger compensation in itself. 
• Data subjects must prove their actual damages suffered, either material or non-material in order to have a right to compensation. 
• The damage must be caused by an infringement of the GDPR by the controller (causal link must be proven as well). 
• A certain degree of seriousness for non-material damage is not required (e.g. loss of control is sufficient), but the CJEU does not accept a data subjects fear caused by a loss of control as grounds for compensation. 

Practical implications for controllers dealing with possibly abusive requests 

The judgment provides clarity for controllers encountering data subject requests of which the GDPR-related intent can be rightfully questioned. 

In practice, Brillen Rottler points to three compliance lessons. 

1. An access request should not be refused merely because the requester may be acting strategically. Strategy is not abuse. 
2. Reliance on publicly available reports about the requester is not enough on its own. Controllers will need case-specific evidence if they want to argue abuse, but it is not ruled out. The intention behind the access request is crucial, if the intention is not for the purpose of being aware of the processing of his/her data, but rather of obtaining compensation, there may be abusive intention; 
3. Refusals should remain exceptional, carefully reasoned within a specific context and well documented. 

Background of the decision 

The case arose before German courts. An Austrian individual subscribed to Brillen Rottler’s newsletter by entering his personal data in the registration form on the website, and thereby consenting to the processing of his personal data by company. The data subject then submitted an access request 13 days later under Article 15 GDPR. Brillen Rottler refused to comply and argued that the request was abusive, relying on publicly available information (reports, blogs, articles, etc.) suggesting that the individual had made systematically similar requests in many other cases in order to pursue compensation claims for alleged infringements. The questions referred to the CJEU therefore concerned Article 12(5), Article 15 and Article 82 GDPR. 

Takeaways 

The Brillen Rottler decision offers an important clarification of the right of access under the GDPR and its possible abuse. The Court confirms that controllers can, in specific circumstances, refuse an access request because the data subject acts with abusive intention. The access request may for example be considered excessive if the data subject acts solely to later seek compensation for ‘damages’ for an alleged infringement. Nevertheless, controllers cannot rely solely on a requester’s history of similar claims to show abuse. Any limitation of a first access request must remain exceptional and strongly depends on the context. In any case, the CJEU confirms that it is up to the data subject to prove any suffered (non-)material damages which are caused by a proven infringement of GDPR rules by the controller. 

We can help your organisation with assessing, documenting and defending an approach to complex data subject requests, including where abusive intent, access rights and GDPR damages exposure may be at stake.