Refusing GDPR access: CJEU on abuse

Abuse is possible even with a first request

A request for access under the General Data Protection Regulation (GDPR) can be abusive even the first time round. That is what the European Court of Justice held on 19 March 2026 (case no. C-526/24). A company may then refuse to provide the information. But it has to show that the applicant was not interested in their data at all, but in artificially manufactured damages. Providing that proof is the real hurdle for companies.

Brillen Rottler, a family-run optician from Arnsberg, gained a new newsletter subscriber from Austria in March 2023. The man entered his details in the sign-up form and consented to the processing. 13 days later, a short acquaintance by the standards of a newsletter subscription, he asked for access to his data. Brillen Rottler refused within the statutory one-month deadline, considered the request abusive and called on the man to desist from it for good.

The company relied on media reports, blog posts and accounts from lawyers. According to these, the man was systematically following a pattern: subscribe to a newsletter, request access, claim damages. The subscriber stuck to his request and demanded 1,000 euros in damages. Brillen Rottler then brought an action before the Local Court of Arnsberg for a declaration that no such claim existed. The man counterclaimed for damages for the refused access. The local court referred the matter to the ECJ.

The right of access and its exception

Anyone can find out from a company whether it processes personal data about them and, if so, which data. This is governed by Article 15 GDPR. The information is free of charge, and the company must provide it within one month. The rationale: if you know what is happening with your data, you can check whether it is lawful and then ask for rectification, erasure or damages.

The GDPR provides for an exception. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the company may charge a reasonable fee or refuse to act. The burden of demonstrating this lies with the company. The Local Court of Arnsberg therefore wondered whether a request can be excessive at all if it is the first one. After all, the legislation speaks of repetition.

Why a first request can be excessive

The ECJ takes the word at its literal meaning: excessive is whatever goes beyond what is usual or reasonable, in quantity or in quality. The legislation mentions frequent repetition merely as an example. An accumulation of requests is an indication of abuse, but not a precondition. What matters is the qualitative assessment of the individual request, and that does not depend on whether it is the first.

Behind the exception lies a general principle of EU law: no one may rely on European provisions abusively. Data protection does not apply without limits; it has to be balanced against other fundamental rights. At the same time, the exception must be interpreted narrowly. A company can invoke it only exceptionally, and the standards for a first request must be high.

The burden of proof lies with the company

For an abuse of rights, the ECJ requires two things. First, objective circumstances showing that, although the request is formally in order, it misses the purpose of the right of access. Second, a subjective element: the intention to obtain an advantage from the GDPR by artificially creating the conditions for it. The company must clearly demonstrate that, with the request, the applicant wanted to lay the groundwork for damages rather than understand how their data was being processed.

All the circumstances of the individual case count here. The ECJ expressly mentions the voluntary provision of the data, the purpose of that provision, the time between the provision and the request, and the person's conduct. Publicly available information indicating that the same person requests access from many companies and then claims damages may be taken into account. On its own it does not justify a refusal; it must be confirmed by other indications.

Whether Brillen Rottler has provided that proof is now for the Local Court of Arnsberg to examine. Material should not be in short supply. In similar proceedings before the Local Court of Augsburg, media reports state that 66 cases involving the same applicant were documented, with claims totalling around 160,000 euros.

Damages even where access is refused

Two further answers from the ECJ should give companies pause before they refuse too hastily. First, damages under the GDPR are available even where a company wrongly refuses access. Unlawful data processing is not required. Second, the loss of control over one's own data, or the uncertainty as to whether it is being processed, already counts as non-material damage. There is no de minimis threshold.

But this is not automatic. The applicant must prove that they actually suffered that damage and that it goes beyond the mere infringement. And the ECJ adds a point that is awkward for professional applicants. Anyone who provided their data only in order to create the conditions for damages artificially has caused the loss of control themselves. If their own conduct is the "decisive cause" of the damage, the claim falls away.

What this means for companies

The judgment is not a blank cheque. The rule remains: a request for access is answered in full and free of charge within one month. A tiresome applicant is not yet an abuse of rights, and nor is a request shortly after sign-up on its own. Anyone who refuses wrongly hands the applicant precisely the infringement they need for their damages claim.

The defence only works in an individual case backed by evidence. It therefore makes sense to document things: when and for what purpose the data was provided, how much time passed before the request, how the applicant behaved afterwards. Reports of similar cases at other companies are one building block, but they do not replace the other indications.

Anyone refusing must do so within the one-month deadline and give reasons, as Brillen Rottler did. A request left unanswered is not a use of the exception. The company is then in breach of its duty to provide access. When in doubt, providing the information is the safer route. Answering costs working time; an unjustified refusal can cost damages and litigation.

Conclusion

The ECJ gives companies an argument against requests for access that are only meant to provoke damages: even a first request can be excessive. The price is a heavy burden of proof. The company must clearly establish the abusive intention on the basis of all the circumstances; public reports alone are not enough.

For the ordinary request for access, nothing changes. It remains free of charge and must be answered within one month. Anyone who refuses prematurely creates the very basis for the damages they wanted to avoid.