Information, yes – but not always and not in every case!
Article 15 of the GDPR grants individuals the right to access their data – specifically, to know whether, and if so, what data a controller is processing. The right of access is intended to enable data subjects to maintain control over their personal data and to exercise their rights under Article 16 et seq. of the GDPR. However, under certain circumstances, the institutions receiving the request may refuse to provide the information.
Right of Access under Article 15 of the GDPR
On the one hand, the right of access is an important tool for protecting against the unlawful processing of personal data. On the other hand, a request for access can sometimes result in considerable effort and costs for the companies receiving the request. And requests are not always made with legitimate intentions. Article 12(5) of the GDPR provides protection against so-called “bad-faith requests for access.” According to this provision, a company may either charge a fee for “excessive” requests or even refuse to provide the information in such cases.
The question of when a request for access is “excessive” and can therefore be rejected was addressed by the Court of Justice of the European Union (CJEU) in its judgment of March 19, 2026, in Case C-526/24. According to the ruling, a request for access is abusive if its sole purpose is to subsequently assert a claim for damages based on an alleged violation of the GDPR.
What was the issue?
A person subscribed to a German company’s newsletter. As part of the newsletter sign-up process, the subscriber entered their personal data on the company’s website.
Just under two weeks after signing up, the subscriber requested access to their personal data from the company whose newsletter they had subscribed to, in accordance with Article 15 of the GDPR.
Various sources, including media reports, blog posts, and reports from attorneys, gave the impression that the subscriber’s actions were part of a pattern: He signed up for newsletters from various companies in order to first request access under Article 15 of the GDPR and then claim damages. For this reason, the company considered his request for information to be abusive and refused to provide it.
Consequently, the subscriber sought damages in the amount of EUR 1,000.00 under Article 82 of the GDPR for non-pecuniary damage he claimed to have suffered as a result of the rejection of his request for information.
The Proceedings
The subscriber had filed a lawsuit seeking information and damages in the Arnsberg Local Court. During the proceedings, the Arnsberg Local Court submitted a so-called request for a preliminary ruling to the European Court of Justice (ECJ). With this request, the Arnsberg Local Court sought clarification from the ECJ as to whether even an initial request for information could be considered “excessive.” It also sought to clarify the conditions under which subscriber s are entitled to damages.
The Judgement
In its decision, the ECJ states that even the first request for information may be “excessive” and thus abusive. This is contingent on the controller – in this case, the company receiving the request – being able to demonstrate that the request for information serves solely to establish the grounds for a claim for damages.
Reports on the subscriber’s known behavior may be taken into account in this assessment.
Regarding the claim for damages asserted, the CJEU held that such a claim generally exists. However, the data subject – in this case, the subscriber – must prove that the refusal to provide information actually caused him or her damage amounting to EUR 1,000.00 in this case.
In the Court’s view, the loss of control over personal data or uncertainty as to whether data has been processed may constitute non-pecuniary damage. However, a claim for damages does not exist if the data subject’s conduct is the decisive cause of the damage – that is, if the data subject, for example, provoked the data processing or the refusal to provide information.
What does this mean?
The European Court of Justice did not rule on this specific case. It is therefore not yet clear whether the company was permitted to refuse to provide the requested information. The court merely commented in general terms on the interpretation of Articles 12(5), 15, and 82 of the GDPR.
It is now up to the Arnsberg Local Court to decide whether the subscriber actually has a right to access the information and, if applicable, to damages, or whether the company in question was justified in refusing to provide the information. In doing so, the court must, of course, take the CJEU’s ruling into account and examine whether the information available to the company regarding the subscriber’s behavior actually suggests a potential violation of applicable data protection law.
Charlotte Werther, LL.M., is a lawyer and research associate at the Open Search Foundation e.V. As part of the PriDI project, she focuses on designing an open search infrastructure that complies with fundamental rights.
