On 19 March 2026, the Court of Justice of the European Union (CJEU) in Case C-526/24 (Brillen Rottler) held that a data subject's first access request may, in certain circumstances, be refused as "excessive" under the EU General Data Protection Regulation (GDPR), including where it is part of a deliberate attempt to generate a compensation claim. The decision provides important clarity for organisations faced with opportunistic or bad-faith data subject access requests (DSARs).
Background
In March 2023, a natural person residing in Austria (TC) subscribed to the newsletter of Brillen Rottler, a family-run optician company based in Arnsberg, Germany. TC subscribed by entering his personal data in the registration form on Brillen Rottler’s website. Thirteen days later, TC submitted a DSAR under Article 15 of the GDPR, which gives data subjects the right to obtain confirmation as to whether their personal data is being processed and, where that is the case, the right of access to that
