In its judgment of 19 March 2026 in Case C-526/24, Brillen Rottler GmbH & Co. KG v. TC, the Court of Justice of the European Union addressed an issue of great practical importance for controllers: whether and when an access request pursuant to Article 15 GDPR can be rejected as "excessive" pursuant to Article 12,  para. 5 GDPR, and whether the violation of the right of access can, in itself, form the basis of a claim for damages pursuant to Art. 82 GDPR.

The dispute arises from the case of a data subject who, after subscribing to the newsletter of a German company in the optical sector and providing his personal data via the relevant online form, had submitted an access request thirteen days later; The company had rejected it as abusive, while the interested party had then also formulated a claim for compensation for moral damage amounting to at least 1,000 euros.

The Court first of all clarifies that not even a first request for access is, in principle, immune from possible classification as "excessive". However, this possibility operates only exceptionally and must be read restrictively, because art. 12, par. 5 GDPR constitutes an exception to the obligation of the data controller to facilitate the exercise of the rights of the data subject. In other words, the fact that it is the first instance does not, in itself, prevent the holder from invoking the abuse; but the criteria for doing so are high and the relative burden of proof rests entirely on the holder himself.

On this point, the Court states that the "excessive" nature cannot be inferred automatically either from the mere number of requests or from a generic suspicion about the intentions of the person concerned. On the other hand, it is necessary to demonstrate, in the light of all the circumstances of the concrete case, that the request was not made to know the processing and verify its lawfulness, i.e. to pursue the typical purpose of art. 15 GDPR, but with an abusive intent, such as the artificial creation of the conditions for obtaining an advantage deriving from the regulation, in particular a claim for damages. The Court also indicates some elements to be evaluated: the fact that the data were provided voluntarily, the purpose of their provision, the time elapsed between the provision and the request for access, as well as the overall conduct of the data subject.

A particularly significant passage concerns the possible relevance of publicly accessible information from which it emerges that the same person has made requests for access and subsequent requests for compensation against multiple data controllers according to a similar modus operandi. The Court accepts that such evidence may be taken into account in order to establish the existence of an abusive intention, but only if it is corroborated by other relevant evidence. It is not enough, therefore, to invoke the existence of a "serial claimant" to reject the request: an unequivocal demonstration of abuse is needed in the specific case.

The second line of the ruling concerns art. 82 GDPR. The Court clearly states that the right to compensation is not limited solely to damage resulting from unlawful treatment in the strict sense. Even the violation of the right of access referred to in art. 15(1) may, in itself, give rise to a right to compensation if the person concerned proves that he or she has suffered material or non-material damage causally linked to that infringement. The point is important because the Court excludes a restrictive reading of art. 82 based on the idea that there must always be, as a prerequisite, unlawful processing in addition to the infringement of the right of the data subject. In this perspective, the unjustified refusal to comply with a request for access can generate liability for compensation.

The ruling, however, does not introduce any automatic compensation. The Court reiterates that the right to compensation presupposes three cumulative elements: a violation of the GDPR, damage actually suffered and a causal link between the violation and the damage. The mere violation of the rule is not enough. With specific regard to non-material damage, the Court confirms that it can also consist in the loss of control over personal data or in uncertainty as to whether or not such data have been processed; but even in this case the person concerned must prove that he has actually suffered such prejudice. A mere abstract allegation or a hypothetical concern is not enough. In addition, compensation may be excluded if the conduct of the person concerned was the determining cause of the damage complained of, as could be the case where it was the person concerned himself who artificially created the conditions for the claim.