Cybersecurity Policy Report, Requests for Personal Data Can Be Regarded as Abusive, EU Court Rules, (Mar 19, 2026)

By Tony Foley

The Court of Justice of the European Union (CJEU) said in a decision released today that a request for access to one’s own personal data could be considered abusive and refused by a controller if it was made for the sole purpose of subsequently claiming compensation for an alleged infringement of the EU General Data Protection Regulation (GDPR).

Background. In the case at issue, according to the court’s press release announcing the decision, an Austrian resident subscribed to a newsletter of Brillen Rottler, a family-owned optician company based in Germany, by entering his personal data in the registration form available on the company’s website. Less than two weeks later, the individual sent Brillen Rottler a request under GDPR article 15, ostensibly to exercise his right to obtain confirmation from the controller as to whether or not personal data about him was being processed, and on receipt of such confirmation, to request access to the data and information related to it. Brillen Rottler refused the request, claiming that it was abusive, citing various reports, blog posts, and lawyers’ newsletters purporting to show that the individual systematically subscribed to newsletters of various companies before submitting a request for access, followed by a claim for compensation. The individual claimed that his request was legitimate and claimed compensation of at least 1,000 euros ($1,159) for non-material damages suffered based on the company’s refusal to comply.

A local German court hearing the dispute asked the CJEU to determine whether a first request for access to personal data made by an individual could be regarded as “excessive” and whether the individual would be entitled to compensation for damages resulting from an infringement.

CJEU ruling. In its ruling (Brillen Rottler GmbH & Co. KG v. TC (Case C-526/24, Mar. 19, 2026), the CJEU found that a first request for access may, in certain circumstances, already be regarded as “excessive” within the meaning of the GDPR and may therefore be abusive. The fact that the individual in this case, based on publicly available information, had made a large number of data access requests, followed by claims for compensation, may be taken into consideration for the purpose of establishing an abusive intention, it said.

The court acknowledged that a person suffering material or non-material damages as a result of a GDPR infringement had the right to receive compensation from the controller for such damages but added that in order to obtain such compensation, a data subject must demonstrate, among other items, that he or she actually suffered the damages claimed. In addition, the CJEU said, a data subject cannot receive compensation for damages if the subject’s conduct is the determining cause of the damage. The CJEU returned the case to the local court to resolve these issues.

News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR