Right of Access to Personal Data : The CJEU Clarifies the Conditions for Abuse of Rights

CJEU, 19 March 2026, Case C-526/24, Brillen Rottler GmbH & Co. KG v. TC

An Austrian individual subscribed to the newsletter of a German optician and, thirteen days later, exercised his right of access to personal data under Article 15 of the General Data Protection Regulation (GDPR). The company refused, taking the view that he had acted repeatedly in order to subsequently claim compensation. He then brought proceedings before the local courts seeking damages. The court stayed the proceedings and referred several preliminary questions to the Court of Justice of the European Union (CJEU).

The ruling delivers two important clarifications:

-A first access request may be deemed excessive. The “excessive” character within the meaning of Article 12(5) GDPR is qualitative, not quantitative: the repetitive nature of requests is mentioned only as an indicative criterion. A first request may therefore be refused, but only exceptionally and subject to strict conditions.

The controller must demonstrate “unequivocally” two cumulative elements:

• an objective element: that the purpose of the request was not to learn about the processing of the data or verify its lawfulness;
• a subjective element: the intent to obtain benefits under the GDPR by artificially engineering the conditions for a damages claim.

The number of requests alone is therefore not determinative of whether a request is excessive. The relevant indicators identified in this case were the short period of time between the provision of the data and the request, and an identical modus operandi used on multiple occasions by the individual concerned, as established by publicly available information. The burden of proof lies entirely with the controller.

-The right to compensation is available, but subject to limitations. Article 82(1) GDPR — under which any person who has suffered material or non-material damage as a result of a breach of the Regulation is entitled to compensation — applies to a breach of the right of access alone, independently of any unlawful processing. However, three cumulative conditions must be met:

• a breach of the GDPR;
• actual damage suffered — loss of control over one’s data or uncertainty as to how it is being processed may suffice, even without proven misuse;
• a causal link. This link is broken where the data subject is themselves the determining cause of their own damage, meaning that a person cannot obtain compensation for harm they have deliberately brought about.

Broader perspective: access requests for evidentiary purposes

The CJEU ruling gives employers an additional argument in cases where a right of access is exercised for evidentiary purposes — though one that must be handled with care.

At the European level, the CJEU makes the rejection of such a request contingent on proof of a characterised abuse of rights: it must be established that the applicant artificially engineered the situation to circumvent the ordinary rules of evidence, and not merely that they are pursuing a litigation objective.

At the French level, certain courts have taken a more restrictive approach, independently of this requirement to prove artificiality. The Paris Court of Appeal (CA Paris, Pôle 6, ch. 2, 18 December 2025, No. 25/04.270) held that the right of access cannot be used by an employee to obtain copies of emails of which they were already aware. The court went further, holding that in this context only identifying information — such as name, address or username — constitutes personal data within the meaning of the GDPR, thereby excluding the very content of communications from the scope of an access request.

This position nevertheless diverges from that of the Chambre sociale of the Court of cassation (Cass. soc., 18 June 2025, No. 23-19.022), which recognises that the content of emails and their metadata are disclosable. Against this backdrop of legal uncertainty, an employer faced with an access request made on the eve of employment tribunal proceedings has arguments available to challenge its purpose — without, however, being in a position to refuse it as a matter of course.