"Manifestly Excessive" Requests Under The GDPR: Numbers Alone Are Not Enough

The CJEU's recent judgment clarifies when data protection requests are "manifestly excessive," providing guidance for controllers on their obligations regarding data subject rights requests.

A recent judgment of the Court of Justice of the European Union (CJEU) (Case C-416/23 Österreichische Datenschutzbehörde v FR) sheds light on the threshold for requests submitted to a data protection supervisory authority to be considered manifestly excessive, in a ruling that will also be of interest to controllers considering the extent of their obligations in the context of data subject right requests.

Background

In April 2020, the Austrian supervisory authority (the DSB) refused to act on a complaint from a data subject (FR) on the basis that it was excessive in nature. FR had made 77 similar complaints regarding different controllers to the DSB within a period of 20 months and had regularly contacted the DSB by phone to make additional requests.