The Court of Justice of the European Union (the “CJEU”) delivered a judgment on 19 March 2026 addressing when a controller may refuse to act on a data subject access request (a “DSAR”) on the basis that it is “excessive” under Article 12(5) GDPR. The CJEU also considered the scope of compensation under Article 82 for infringements of the right of access under Article 15.
Background
The case concerned an Austrian resident who subscribed to the newsletter of Brillen Rottler, a German optician, by filling out a form on their website. Thirteen days later, the individual submitted a DSAR under Article 15 GDPR. Brillen Rottler refused the DSAR on the grounds that it was abusive within the meaning of Article 12(5) GDPR and invited the requester to withdraw it. Article 12(5) provides that where a controller can demonstrate that “requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character,” the controller may either refuse the
