AG Clarifies When A DSAR Constitutes An Abuse Of GDPR Rights

Advocate General ("AG") Spunzar, in case C-526/24, recently delivered a significant opinion on when a data subject access request ("DSAR") may be deemed to be an abuse of one's data protection rights and "excessive" under Article 12(5) GDPR. The Opinion provides some further clarity in regard to the limits to the exercise of the right of access under Article 15 GDPR, and the right to compensation under Article 82 GDPR, where these rights are invoked in an abusive manner.

The AG opined that the mere fact that a person has made similar claims for damages for GDPR infringements in the past is not, in itself, sufficient to prove abusive intent. The decisive factor is the underlying purpose of the data subject's actions, such as deliberately creating a relationship with the controller for the purpose of exploiting their data protection rights, and causing the controller to refuse the DSAR.