CJEU: First Request For Access May Be Rejected As Abusive Under GDPR

In its March 19, 2026, judgment in Case C-526/24 (Brillen Rottler), the CJEU ruled that even a first request for access to personal data under the GDPR may be deemed abusive if not made in good faith. 

Key Takeaways

• A first-access request under Article 15 GDPR may be classified as “excessive” under Article 12(5). The controller bears a high burden of proof and must demonstrate that the data subject acted with abusive intent rather than a genuine interest in verifying the lawfulness of data processing.
• Publicly available information — such as media reports or blog posts documenting a data subject’s pattern of filing serial access requests followed by damages claims against multiple controllers — may be considered as a factor in the abuse assessment, though not as the sole basis.