Newsletter: Excessive Access Request Under Art. 12(5) GDPR – CJEU Judgment (C-526/24, 19 March 2026)

In its recent judgment (Rs. C‑526/24), the European Court of Justice (ECJ) shed some light on data subject access rights and potential damages connected thereto:

The ECJ held that a first data subject access request can be “excessive” under the GDPR (the amount of requests is not necessarily the main indicator for excessiveness).

A request can be “excessive” if it was not made for a data protection-related purpose, but rather with an abusive intent.

The ECJ further held that Art. 82(1) GDPR provides data subjects a right to compensation for damages resulting from a breach of their right to access.

Finally, the ECJ held that Art. 82(1) GDPR also encompasses non-material damages due to the loss of control over personal data or uncertainty as to whether such data have been processed. However, the data subject needs to show that he/she has actually suffered damages and that their own conduct was not the decisive cause thereof.