On March 19, 2026, the Court of Justice of the European Union (CJEU) issued its judgment in Brillen Rottler (C-526/24), addressing two issues that frequently arise in practice:
(i) the misuse of data subject access requests (DSARs) for abusive purposes
(ii) the growing risk of compensation claims under the GDPR.
The Court held that a first DSAR can be refused as “excessive” within the meaning of Article 12(5) GDPR where the controller demonstrates abusive intent in light of all relevant circumstances, for example where the request is aimed at artificially creating the conditions for a compensation claim rather than genuinely understanding the processing and verifying its lawfulness. At first glance, the decision appears to offer controllers a long-awaited tool to push back against abusive or opportunistic DSARs. A closer reading, however, shows that the relief will probably be construed narrowly, subject to a stringent evidentiary threshold.
The German court’s subsequent decision of July 1, 2026, in the underlying case confirms that the specific circumstances of the case are key to determining the abusive intent of a DSAR. The Court meticulously listed all the facts before concluding that the DSAR in that case was in fact excessive. The decision shows how the abuse and excessiveness assessment may be applied in practice: the controller must be able to evidence a consistent bundle of facts. A single suspicion or general allegations will likely not be sufficient.
The CJEU’s decision should also be read alongside the EDPB’s recent binding decision in the VRT v. NOYB matter, published on July 14, 2026, which addressed, among other things, whether a supervisory authority could dismiss a GDPR complaint on the basis of abuse of rights. Although the EDPB’s decision concerns complaints rather than DSARs, it is relevant because the EDPB expressly linked the abuse analysis to Article 57(4) GDPR, which shares the same “manifestly unfounded or excessive” wording with Article 12(5), and the general EU law principle that rights cannot be relied on for abusive or fraudulent ends, which underpins the CJEU’s decision in Brillen Rottler. The EDPB decision cites the Brillen Rottler case on several occasions.
Background
The dispute arose after an Austrian resident subscribed to the newsletter of Brillen Rottler, a German optical company, by completing an online registration form and voluntarily providing his personal data. Thirteen days later, he submitted a DSAR under Article 15 GDPR. Brillen Rottler refused the request, arguing that it was abusive. The individual maintained his request and added a claim for EUR 1,000 in non-material damages under Article 82 GDPR.
The company then brought proceedings before a German court seeking a declaratory judgment, relying inter alia on publicly available information suggesting that the individual systematically submitted access requests with a view to bringing compensation claims. The individual contested this characterization and counterclaimed for damages.
The referring court asked the CJEU, in substance, whether:
- a first access request can be considered “manifestly excessive” under Article 12(5) GDPR
- compensation under Article 82 GDPR may arise from a breach of the right of access itself
- non-material dam age may consist of loss of control over personal data or uncertainty regarding its processing.
1. Outcome of the CJEU’s decision
1.1 Clarification on abusive DSARs
The CJEU confirmed that Article 12(5) GDPR is not limited to repetitive requests. A first DSAR may, in principle, be refused as “manifestly excessive” if the controller establishes that the request was made with an abusive intention and for a purpose alien to the right of access.
The Court stressed, however, that Article 12(5) constitutes an exception to the general obligation to facilitate data subject rights and must therefore be interpreted restrictively.
To rely on this exception, the controller must demonstrate both:
i. an objective element, namely that the request does not pursue the purpose of the right of access (i.e. enabling the data subject to understand the processing and verify its lawfulness)
ii. a subjective element, namely that the request is made with an abusive intention, which may include, depending on the circumstances, seeking an advantage or aiming to cause harm (e.g. generating costs for the controller).
The assessment must be based on a global evaluation of the circumstances, including factors such as the voluntary nature of the data provision, the time elapsed between collection and the request, and the data subject’s overall conduct.
The Court clarified that allegations of systematic behavior or the data subject’s public profile may be taken into account but are not sufficient on their own.
1.2 Compensation risk
The Court clarified that Article 82 GDPR is not limited to damage resulting from unlawful processing operations. A failure to comply with Articles 12 to 15 GDPR (for example, an unjustified refusal or improper handling of a DSAR) may, in principle, give rise to liability.
However, this does not lower the threshold for compensation. The data subject must still establish:
- a fault (i.e. an infringement of the GDPR)
- actual damage
- a causal link between the two.
In practice, this remains a demanding test. While there is no de minimis threshold for non-material damage, the Court confirmed that mere allegations are insufficient. In particular, a claimed fear of misuse must be “well founded, in the specific circumstances of the case and with regard to the data subject concerned.” Accordingly, while procedural infringements may theoretically trigger liability, the practical likelihood of successful claims remains constrained by evidentiary requirements.
1.3 Non-material damage
The Court confirmed that non-material damage may include loss of control over personal data or uncertainty as to whether data has been processed. However, compensation is not automatic. The data subject must prove that the damage was genuinely suffered and that it is causally linked to the infringement.
Importantly, and this is a notable clarification in the Court’s case law, the CJEU recognized that the data subject’s own deliberate conduct may preclude or undermine the necessary causal link., for example, where the data subject intentionally creates the conditions for a compensation claim by voluntarily providing personal data for that purpose.
2. Lessons from the Arnsberg Court’s application of the CJEU’s ruling
2.1 The assessment of abusive intent
The Arnsberg Court did not regard the DSAR as abusive merely because the claimant had allegedly brought similar claims elsewhere. Rather, it identified a consistent factual pattern supporting the conclusion that the claimant’s true intention was to manufacture a compensation claim. In this respect, the German court relied on the following bundle of indicators:
i. The voluntary provision of more data than necessary. The claimant used a non-anonymous email address and provided his full name, although only the email address was necessary for the newsletter subscription.
ii. The absence of plausible commercial or personal interest in the newsletter. The German court considered it unconvincing that an Austrian resident had a genuine interest in a newsletter focused on discounts in North Rhine-Westphalia branches, particularly where the online shop shipped only within Germany.
iii. The short time between subscription and the DSAR. The German court noted that only a very short period elapsed between the provision of the data and the DSAR, which it considered a further indication that the claimant sought to create the conditions for a damages claim.
iv. The way the DSAR was made. The claimant sent the request by fax using a complete letterhead, thereby voluntarily disclosing additional personal data beyond what was required.
v. The absence of any complaint to the data protection authority. The German court reasoned that if the claimant’s real aim had been to clarify or prevent data protection infringements, a complaint to the supervisory authority would have been a more effective route than a single direct damages demand.
vi. The uncooperative behavior in court. The data subject did not appear at the oral hearing despite an order requiring his personal appearance. The German court viewed this as an additional indication of abusive intent, as the data subject could have used the opportunity to substantiate his genuine personal interest and explain the high number of similar cases that he had filed.
vii. The use by the controller of publicly available information about the data subject’s similar claims. The German court accepted that the controller could take such information into account because it was supported by other concrete indicators of abuse.
viii. The claimant’s inconsistent conduct. The German court considered it inconsistent for a person claiming to be highly data-sensitive to repeatedly subscribe voluntarily to newsletters, including one for a company in which no genuine interest was established, while disclosing more personal data than necessary.
These findings are significant because they confirm that the abuse defense is not a shortcut. Controllers must rely on contemporaneous, concrete and well-documented evidence, rather than assumptions, to justify any refusal under Article 12(5) GDPR.
2.2 Compensation
The German court expressed doubts as to whether the claimant had sufficiently substantiated the alleged damage. More importantly, it held that any claim would in any event fail because the alleged loss of control and uncertainty resulted from the claimant’s own conduct. This is best understood as a causation point: where the claimant deliberately creates the circumstances giving rise to the alleged damage, it may be difficult to establish that the controller’s conduct caused that damage.
2.3 Assessment of the formal requirements of the refusal letter
The German court dismissed the claim that the refusal letter was formally deficient. It found that Brillen Rottler had replied within the relevant time limit, had clearly and sufficiently explained the grounds for refusal, and had provided adequate information about the remedies available to the data subject.
In particular, the court held that it was enough for the controller to refer to the possibility of complaining to the supervisory authority of North Rhine Westfalen (versus listing all the supervisory authorities that are possibly competent to receive the data subject’s complaint) or bringing proceedings before a court. This part of the ruling underlines that a controller must still deal with a DSAR in a procedurally robust way, even where it suspects abuse. A refusal that is late or inadequately reasoned can create risk, even if the suspicion of abuse is well-founded.
3.The EDPB adopts a strict interpretation of the abuse of rights
The EDPB’s recent binding decision in the VRT v. NOYB matter confirms that the abuse of rights doctrine will be applied cautiously in the GDPR context.
It emphasized that the prohibition of abuse must be interpreted strictly. It explained that an overly broad application of the concept could unduly restrict the exercise of rights conferred by EU law, including rights protected by the Charter of Fundamental Rights of the European Union, such as the fundamental right to data protection.
Crucially, the EDPB did not consider an organized, strategic or assisted exercise of GDPR rights to be abusive in itself. It acknowledged that NOYB had played a leading role in a coordinated complaint project, including by identifying controllers according to pre-defined criteria and using automated means.
However, the EDPB still found that the objective component of abuse was absent. In its view, the formal conditions for mandating NOYB under the GDPR had been observed and the purpose for which organizations such as NOYB are entrusted with representing complainants appeared to have been fulfilled.
The EDPB also rejected the argument that the subjective component of abuse had been established. It found insufficient evidence that NOYB had pursued its own interests rather than those of the data subject. This was so despite the fact that the data subject was not a Dutch native speaker, accessed VRT’s website in Dutch from Austria, and did so while carrying out a traineeship on behalf of NOYB. For the EDPB, these circumstances did not demonstrate abusive intent.
On the contrary, the EDPB considered that professional assistance and representation fitted with the intended purpose of Articles 77 and 80(1) GDPR.
A particularly interesting aspect of the decision is that the EDPB expressly took into account, as an argument weighing against a finding of abuse, that “neither the BE SA nor the Controller demonstrate that a compensation under Article 82 GDPR or any other financial benefit has been sought.” This appears to be an implicit distinction from, and justification in light of, the Brillen Rottler case.
The EDPB’s decision therefore reinforces the narrow scope of the abuse defense. It suggests that controllers and supervisory authorities will need to identify concrete evidence that the GDPR right is being used for a purpose contrary to that for which it was conferred, and not merely that the right is being exercised in a planned or campaign-driven manner.
4. Practical implications for controllers
While the decisions confirm that abusive DSARs may be refused, they do not relax core compliance obligations. The default position remains that DSARs must be answered fully and within statutory deadlines, even where they are burdensome, strategically motivated, or litigation driven.
In practice, the evidentiary threshold for demonstrating abusive intention is sufficiently high that most controllers will remain reluctant to rely on Article 12(5) GDPR. At the same time, misjudging a DSAR, particularly by incorrectly classifying it as abusive, may expose controllers to both regulatory scrutiny and civil claims.
As a result, the decisions reinforce the need for:
- robust internal DSAR procedures
- careful documentation of decision-making
- legally defensible, proportionate responses.
The decisions point towards calibrated approaches (such as clarification requests, scoped searches,. redactions, partial disclosures, or staged access), rather than outright refusals, except in genuinely exceptional cases.
4.1 Luxembourg perspective
In Luxembourg, DSARs are frequently used in employment related disputes, including:
- pre termination and termination scenarios
- internal investigations and whistleblowing procedures
- discrimination, harassment, or performance disputes.
The Brillen Rottler judgment confirms that a DSAR does not become abusive solely because it is used in a litigation context. Employees may therefore rely on access rights even where the request is clearly strategic.
This is consistent with the EDPB’s broader warning that abuse-of-rights arguments must not be applied so broadly that they unduly restrict the exercise of rights conferred by EU law.
Controllers must continue to reconcile DSAR obligations with:
- the right to privacy in the workplace
- the protection of witnesses and third parties
- secrecy requirements in internal investigations.
In our experience, the CNPD has been reluctant to accept abuse of rights arguments in the context of DSARs, even where there are indications that a request is being used to exert pressure in a parallel dispute. It remains to be seen whether and to what extent the CJEU’s judgment will influence this position.
Conclusion
So, relief for controllers or false hope?
The classic lawyer’s answer is it depends. The positive takeaway is that Brillen Rottler confirms that DSARs can in fact be abusive, which is helpful given that, in our experience, the CNPD has so far been reluctant to accept this argument. The flipside is that the evidentiary threshold remains high: controllers will need a consistent bundle of concrete facts showing abusive intent.
The EDPB decision in VRT v. NOYB further confirms that supervisory authorities are likely to apply the abuse-of-rights doctrine cautiously. It shows that supervisory authorities are unwilling to find abuse merely because a DSAR or complaint forms part of a broader campaign conducted by a civil rights organization.
For controllers, the practical takeaway is therefore to comply first and challenge later. While the controller in Brillen Rottler successfully defended its outright rejection of the DSAR on the grounds of abuse, this defense is likely to be accepted only in exceptional circumstances. A simple suspicion or the fact that the DSAR was made in the context of a dispute will likely not be enough.
To avoid undue risks, most controllers will therefore be better advised to comply with the DSAR in the first instance and invoke the abuse-of-rights doctrine as part of their defense should the matter escalate into a complaint before a supervisory authority or a compensation claim.
