Skip to main content
Praxikon

Ruling

Brillen Rottler: even a first access request can be abusive if made solely to claim compensation

Date
Status
final
Body
Hof van Justitie van de EU (Vierde kamer), Brillen Rottler GmbH & Co. KG tegen TC
Reference
C-526/24, ECLI:EU:C:2026:216

What it is about

Question: may a controller refuse a first access request as excessive where the requester evidently makes it only to claim compensation afterwards, and does the requester have a right to compensation when access is refused? Ruling: a first request can be excessive and thus abusive where the controller shows it was made not to know and verify the processing but to artificially create a claim; a publicly known pattern of many requests followed by claims may be taken into account. Breach of the right of access does give a right to compensation for damage actually suffered, even without any processing and including loss of control or uncertainty, but not where the data subject's own conduct is the determining cause.

What this means in practice

You may not refuse an access request lightly, but you now have a concrete defence against claim farmers, provided you substantiate the abuse with facts. Record in your access procedure how you assess and document indications of abuse, and keep handling ordinary requests within one month. Remain careful: an unjustified refusal remains an infringement that can lead to compensation.

The GDPR articles concerned

Source: EUR-Lex, arrest C-526/24checked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

Case law

Guidelines

Legislation in motion