A personal data access request may be refused and regarded as abusive where it is made solely with the intention of claiming damages for an alleged infringement of the General Data Protection Regulation (GDPR).

Facts of the case

The dispute concerned claims for damages arising from alleged GDPR infringements. The claimant subscribed to the optician Brillen Rottler’s newsletter and voluntarily provided his personal data. Thirteen days later, he made an access request under Article 15 GDPR. The company refused the request on the grounds that it constituted an abuse of rights. According to publicly available information, the claimant had repeatedly submitted comparable access requests to companies and subsequently brought claims for damages based on alleged GDPR infringements, a practice referred to as “GDPR hopping”. The claimant argued that his access request had been legitimate and, in turn, sought compensation for non-material damage arising from the refusal to provide access. In a preliminary reference, the Local Court asked the CJEU, among other things, whether a request may be regarded as excessive even when made for the first time and may therefore be refused pursuant to the second sentence of Article 12(5) and Article 15 GDPR.

Decision

The CJEU held that a first access request may be “excessive” within the meaning of Article 12(5) GDPR where specific circumstances establish an abuse of the right of access. The decisive issue is whether the request genuinely seeks information about the processing of personal data and verification of its lawfulness, or is made solely to create the basis for subsequent damages claims.

Whether a request is abusive must be assessed in light of all the circumstances of the individual case. Relevant factors may include the data subject’s voluntary disclosure of the data, the short interval between disclosure and the access request, and publicly known comparable requests and damages claims against other controllers.

The CJEU further confirmed that an infringement of the right of access may, in principle, give rise to damages under Article 82 GDPR. The claimant must, however, establish actual material or non-material damage; a mere “loss of control” is insufficient. A claim also fails for lack of causation where the data subject’s own conduct — here, the deliberate disclosure of the data — was the decisive cause of the alleged damage.

(CJEU, 19 March 2026 – C-526/24 / Brillen Rottler)

Practical takeaways

  • The judgment strengthens an employers’ position when responding to manifestly tactical GDPR access requests, even where the individual is making a request for the first time.
  • However, the controller bears the burden of proof in demonstrating that the right of access is being exercised exclusively for purposes unrelated to its proper function. Employers should therefore continue to handle access requests carefully and consider refusing a request only where there are sufficiently substantiated indications of an abuse of rights.