At a time when many organizations are seeing a rise in strategic, and sometimes even outright abusive, data subject access requests (“DSARs”), the Court of Justice of the European Union’s (“CJEU’s”) 19 March 2026 decision in Brillen Rottler (Case C-526/24) has been welcomed as a potential shift in the balance. The ruling appears to offer support for controllers dealing with requests driven less by transparency concerns and more by tactical leverage. However, a closer examination suggests that its practical implications may be more constrained in typical operational contexts.
The case arose when a data subject lodged a DSAR just thirteen days after signing up for Brillen Rottler’s newsletter on its website. The company, a German-based family run optician, refused the request on the basis that it was excessive, relying on Article 12(5) GDPR, pointing to evidence suggesting a broader pattern: subscribe, request access, then seek compensation where a request is denied or mishandled. The
