Business Emails And DSARs

How French Courts Are Redefining the Scope of 'Personal Data' Under the GDPR

Article 15 of the EU General Data Protection Regulation (GDPR) grants users the right to access their data: this broadly requires that the data subject has the right to know whether their personal data is being processed and if its processing is lawful. This right is often weaponized, creating compliance challenges for large companies who can face abusive Data Subject Access Requests (DSARs). In a recent decision¹, the Court of Justice of the European Union Court held that a DSAR may, under certain circumstances, be considered excessive (and therefore not one to which a data controller needs to respond) if a data controller can demonstrate that the request is made not to verify the lawfulness of the data processing but with the intention of artificially creating the conditions required to obtain redress under the GDPR. The recent EU Digital Omnibus regulation proposal specifically tackles the issue of