{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-526-24", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-526-24)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-14", "fingerprint": "ewai:eu:f8b9a4", "proof": "sha256:faa524994b3fb344dde3ba37ac7fde6b25475c98219763ce4b9b343caffb8862", "jurisdiction": "eu", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "item": { "schema_version": "1.0.0", "id": "eu:c-526-24", "jurisdiction": "eu", "lang": "en", "brand_source": "Source: NovaCopilot", "brand": { "product": "NovaCopilot", "platform": "ExploreWorldAI", "infrastructure": "ExploreWorld Legal", "infrastructure_url": "legal.exploreworldai.com", "legal_entity": "Valkiv Ventures AB", "permanent_url": "https://legal.exploreworldai.com/novacopilot", "source": "Source: NovaCopilot", "powered_by": "Powered by NovaCopilot", "license": "https://legal.exploreworldai.com/licensvillkor" }, "sections": [ { "title": "Provisional text", "paragraphs": [] }, { "title": "JUDGMENT OF THE COURT (Fourth Chamber)", "paragraphs": [] }, { "title": "19 March 2026 ( * )", "paragraphs": [ "para_4", "para_5", "para_6" ] }, { "title": "Brillen Rottler GmbH & Co. KG", "paragraphs": [ "para_8", "para_9", "para_10", "para_11", "para_12", "para_13", "para_14", "para_15", "para_16", "para_17", "para_18", "para_19", "para_20" ] }, { "title": "Judgment", "paragraphs": [ "para_22", "para_23" ] }, { "title": "Legal context", "paragraphs": [] }, { "title": "3         Recitals 4, 10, 11, 63, 85, 141 and 146 of the GDPR state:", "paragraphs": [ "para_26", "para_27", "para_28", "para_29", "para_30", "para_31", "para_32", "para_33", "para_34", "para_35", "para_36" ] }, { "title": "4         Article 4 of that regulation, entitled ‘Definitions’, provides:", "paragraphs": [ "para_38", "para_39", "para_40", "para_41", "para_42", "para_43", "para_44", "para_45", "para_46", "para_47", "para_48", "para_49", "para_50", "para_51", "para_52", "para_53", "para_54", "para_55", "para_56", "para_57", "para_58", "para_59", "para_60", "para_61", "para_62", "para_63", "para_64", "para_65", "para_66", "para_67", "para_68", "para_69" ] }, { "title": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraphs": [ "para_71", "para_72", "para_73", "para_74", "para_75", "para_76", "para_77", "para_78", "para_79", "para_80", "para_81", "para_82", "para_83", "para_84", "para_85", "para_86", "para_87" ] }, { "title": "Consideration of the questions referred", "paragraphs": [] }, { "title": "The first to third and seventh questions", "paragraphs": [ "para_90", "para_91", "para_92", "para_93", "para_94", "para_95", "para_96", "para_97", "para_98", "para_99", "para_100", "para_101", "para_102", "para_103", "para_104", "para_105", "para_106", "para_107", "para_108", "para_109", "para_110", "para_111", "para_112", "para_113", "para_114" ] }, { "title": "The fifth and sixth questions", "paragraphs": [ "para_116", "para_117", "para_118", "para_119", "para_120", "para_121", "para_122", "para_123", "para_124", "para_125" ] }, { "title": "The fourth question", "paragraphs": [ "para_127" ] }, { "title": "The eighth question", "paragraphs": [ "para_129", "para_130", "para_131", "para_132", "para_133", "para_134", "para_135", "para_136", "para_137", "para_138", "para_139" ] }, { "title": "Costs", "paragraphs": [ "para_141" ] }, { "title": "On those grounds, the Court (Fourth Chamber) hereby rules:", "paragraphs": [ "para_143", "para_144" ] }, { "title": "2.       Article 82(1) of Regulation 2016/679", "paragraphs": [ "para_146" ] }, { "title": "3.       Article 82(1) of Regulation 2016/679", "paragraphs": [ "para_148", "para_149", "para_150" ] } ], "paragraphs": [ { "text": "Provisional text", "paragraph_id": "para_1" }, { "text": "JUDGMENT OF THE COURT (Fourth Chamber)", "paragraph_id": "para_2" }, { "text": "19 March 2026 ( * )", "paragraph_id": "para_3" }, { "text": "( Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 12(5) – Article 15(1) – Data subject’s right of access to the personal data concerning him or her – Controller’s right to refuse to act on the requ …", "paragraph_id": "para_4" }, { "text": "In Case C‑526/24,", "paragraph_id": "para_5" }, { "text": "REQUEST for a preliminary ruling under Article 267 TFEU from the Amtsgericht Arnsberg (Local Court, Arnsberg, Germany), made by decision of 31 July 2024, received at the Court on the same day, in the proceedings", "paragraph_id": "para_6" }, { "text": "Brillen Rottler GmbH & Co. KG", "paragraph_id": "para_7" }, { "text": "v", "paragraph_id": "para_8" }, { "text": "TC,", "paragraph_id": "para_9" }, { "text": "THE COURT (Fourth Chamber),", "paragraph_id": "para_10" }, { "text": "composed of I. Jarukaitis, President of the Chamber, K. Lenaerts, President of the Court, acting as Judge of the Fourth Chamber, M. Condinanzi, N. Jääskinen and R. Frendo (Rapporteur), Judges,", "paragraph_id": "para_11" }, { "text": "Advocate General: M. Szpunar,", "paragraph_id": "para_12" }, { "text": "Registrar: I. Illéssy, Administrator,", "paragraph_id": "para_13" }, { "text": "having regard to the written procedure and further to the hearing on 5 June 2025,", "paragraph_id": "para_14" }, { "text": "after considering the observations submitted on behalf of:", "paragraph_id": "para_15" }, { "text": "–        Brillen Rottler GmbH & Co. KG, by J. Tröber, Rechtsanwalt,", "paragraph_id": "para_16" }, { "text": "–        TC, by P. Brandt, Rechtsanwalt,", "paragraph_id": "para_17" }, { "text": "–        the European Commission, by A. Bouchagiar, M. Heller and H. Kranenborg, acting as Agents,", "paragraph_id": "para_18" }, { "text": "after hearing the Opinion of the Advocate General at the sitting on 18 September 2025,", "paragraph_id": "para_19" }, { "text": "gives the following", "paragraph_id": "para_20" }, { "text": "Judgment", "paragraph_id": "para_21" }, { "text": "1         This request for a preliminary ruling concerns the interpretation of point 2 of Article 4, Article 12(5) and Article 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).", "paragraph_id": "para_22" }, { "text": "2         The request has been made in proceedings between Brillen Rottler GmbH & Co. KG, a family run optician company, and TC, an individual, concerning that company’s refusal to grant TC’s request for access to his personal data pursuant to Article 15 of the GDPR.", "paragraph_id": "para_23" }, { "text": "Legal context", "paragraph_id": "para_24" }, { "text": "3         Recitals 4, 10, 11, 63, 85, 141 and 146 of the GDPR state:", "paragraph_id": "para_25" }, { "text": "‘(4)      The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of pro …", "paragraph_id": "para_26" }, { "text": "…", "paragraph_id": "para_27" }, { "text": "(10)      In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the [European] Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equi …", "paragraph_id": "para_28" }, { "text": "(11)      Effective protection of personal data throughout the [European] Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States.", "paragraph_id": "para_29" }, { "text": "…", "paragraph_id": "para_30" }, { "text": "(63)      A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. …", "paragraph_id": "para_31" }, { "text": "(85)      A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, …", "paragraph_id": "para_32" }, { "text": "…", "paragraph_id": "para_33" }, { "text": "(141)      Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed …", "paragraph_id": "para_34" }, { "text": "…", "paragraph_id": "para_35" }, { "text": "(146)      The controller … should compensate any damage which a person may suffer as a result of processing that infringes this Regulation. The controller … should be exempt from liability if it proves that it is not in any way responsible for the damage. The concept of damage should be broadly int …", "paragraph_id": "para_36" }, { "text": "4         Article 4 of that regulation, entitled ‘Definitions’, provides:", "paragraph_id": "para_37" }, { "text": "‘For the purposes of this Regulation:", "paragraph_id": "para_38" }, { "text": "…", "paragraph_id": "para_39" }, { "text": "(2)      “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;", "paragraph_id": "para_40" }, { "text": "…’", "paragraph_id": "para_41" }, { "text": "5         Article 12 of the GDPR, entitled ‘Transparent information, communication and modalities for the exercise of the rights of the data subject’, provides, in paragraphs 1, 2 and 5 thereof:", "paragraph_id": "para_42" }, { "text": "‘1.      The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject …", "paragraph_id": "para_43" }, { "text": "2.      The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. …", "paragraph_id": "para_44" }, { "text": "…", "paragraph_id": "para_45" }, { "text": "5.      Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:", "paragraph_id": "para_46" }, { "text": "(a)      charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or", "paragraph_id": "para_47" }, { "text": "(b)      refuse to act on the request.", "paragraph_id": "para_48" }, { "text": "The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.’", "paragraph_id": "para_49" }, { "text": "6         Article 15 of the GDPR, entitled ‘Right of access by the data subject’, provides, in paragraph 1 thereof:", "paragraph_id": "para_50" }, { "text": "‘The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:", "paragraph_id": "para_51" }, { "text": "…’", "paragraph_id": "para_52" }, { "text": "7         Article 26 of the GDPR, entitled ‘Joint controllers’, provides, in paragraph 1 thereof:", "paragraph_id": "para_53" }, { "text": "‘Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. …’", "paragraph_id": "para_54" }, { "text": "8         Article 30 of that regulation, entitled ‘Records of processing activities’, provides, in paragraph 1 thereof:", "paragraph_id": "para_55" }, { "text": "‘Each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility. …’", "paragraph_id": "para_56" }, { "text": "9         Article 57 of that regulation, entitled ‘Tasks’, provides, in paragraphs 1 and 4 thereof:", "paragraph_id": "para_57" }, { "text": "‘1.      Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:", "paragraph_id": "para_58" }, { "text": "…", "paragraph_id": "para_59" }, { "text": "(f)      handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint …;", "paragraph_id": "para_60" }, { "text": "…", "paragraph_id": "para_61" }, { "text": "4.      Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.’", "paragraph_id": "para_62" }, { "text": "10       Article 79 of that regulation, entitled ‘Right to an effective judicial remedy against a controller or processor’, provides, in paragraph 1 thereof:", "paragraph_id": "para_63" }, { "text": "‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.’", "paragraph_id": "para_64" }, { "text": "11       Article 82 of the GDPR, entitled ‘Right to compensation and liability’, provides, in paragraphs 1, 2 and 4 thereof:", "paragraph_id": "para_65" }, { "text": "‘1.      Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.", "paragraph_id": "para_66" }, { "text": "2.      Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. …", "paragraph_id": "para_67" }, { "text": "…", "paragraph_id": "para_68" }, { "text": "4.      Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.’", "paragraph_id": "para_69" }, { "text": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraph_id": "para_70" }, { "text": "12       In March 2023, TC, a natural person residing in Austria, subscribed to the newsletter of Brillen Rottler, a family run optician company established in Arnsberg (Germany), by entering his personal data in the registration form available on that company’s website and consenting to the processing of those data. Thirteen days later, TC sent a request for access to Brillen Rottler under Article 15 of the GDPR.", "paragraph_id": "para_71" }, { "text": "13       Within the period of one month set in the regulation, Brillen Rottler refused the request for access, considering it to be abusive, within the meaning of the second sentence of the first subparagraph of Article 12(5) of the GDPR. It called on TC to withdraw his request definitively.", "paragraph_id": "para_72" }, { "text": "14       After TC maintained his request for access, while adding a claim for compensation under Article 82 of the GDPR in the amount of EUR 1 000, Brillen Rottler submitted to the Amtsgericht Arnsberg (Local Court, Arnsberg, Germany), which is the referring court, a claim for a declaration that TC is not entitled to any compensation.", "paragraph_id": "para_73" }, { "text": "15       In support of its claim, Brillen Rottler submits that it is apparent from various reports, blog articles and lawyers’ newsletters that TC systematically and abusively makes requests for access to his personal data for the sole purpose of obtaining compensation for an alleged infringement, w …", "paragraph_id": "para_74" }, { "text": "16       TC submits before the referring court that the request for access which he made to Brillen Rottler is legitimate, that it is an expression of the right of access conferred on him by Article 15 of the GDPR and that that company is seeking unlawfully to restrict the rights conferred on him by …", "paragraph_id": "para_75" }, { "text": "17       In the first place, the referring court is uncertain as to whether a first request for access made by the data subject may be regarded as an ‘excessive request’ for the purposes of Article 12(5) of the GDPR and, thus, constitute an abuse of rights, and what circumstances make it possible to …", "paragraph_id": "para_76" }, { "text": "18       In the second place, that court asks whether a request for access made under Article 15(1) of the GDPR and/or the response to such a request constitutes ‘processing’ within the meaning of point 2 of Article 4 of the GDPR.", "paragraph_id": "para_77" }, { "text": "19       In the third place, that court harbours doubts as to the criteria for identifying the damage that may be compensated under Article 82(1) of the GDPR, and in particular as to whether, even where there has been no processing, that article confers a right to compensation solely on the basis of the infringement of the right of access provided for in Article 15(1) of that regulation.", "paragraph_id": "para_78" }, { "text": "20       In those circumstances, the Amtsgericht Arnsberg (Local Court, Arnsberg) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:", "paragraph_id": "para_79" }, { "text": "‘(1)      Is the second sentence of [the first subparagraph of] Article 12(5) of the [GDPR] to be interpreted as meaning [that] there cannot be an excessive [request for access] from the data subject when the first request is made to the controller?", "paragraph_id": "para_80" }, { "text": "(2)      Is the second sentence of [the first subparagraph of] Article 12(5) of the GDPR to be interpreted as meaning that the controller can refuse [a request for access] from the data subject if the data subject intends to use the [request for access] to provoke claims for damages against the controller?", "paragraph_id": "para_81" }, { "text": "(3)      Is the second sentence of [the first subparagraph of] Article 12(5) of the GDPR to be interpreted as meaning that grounds for refusing to provide information can be provided by publicly available information about the data subject which suggests that the data subject is asserting claims for damages against the controller in a large number of cases of infringement of the law relating to the protection of personal data?", "paragraph_id": "para_82" }, { "text": "(4)      Is [point 2 of Article 4] of the GDPR to be interpreted as meaning that [a request for access] from a data subject to the controller pursuant to Article 15(1) of the GDPR and/or a response to that request constitutes processing within the meaning of [the first of those provisions]?", "paragraph_id": "para_83" }, { "text": "(5)      In view of the first sentence of recital 146 of the GDPR, is Article 82(1) thereof to be interpreted as meaning that only damage which the data subject suffers or has suffered as a result of processing is eligible for compensation? Does this mean that for there to be a claim for damages under Article 82(1) of the GDPR – assuming causal damage to the data subject exists – there must necessarily have been processing of the data subject’s personal data?", "paragraph_id": "para_84" }, { "text": "(6)      If the answer to Question 5 is in the affirmative: does this mean that the data subject – assuming causal damage exists – has no claim for compensation under Article 82(1) of the GDPR solely on the basis of an infringement of his or her right [of access] under Article 15(1) of the GDPR?", "paragraph_id": "para_85" }, { "text": "(7)      Is Article 82(1) of the GDPR to be interpreted as meaning that the controller’s objection relating to an abuse of right in relation to [a request for access] from the data subject cannot, in view of EU law, consist in the fact that the data subject brought about processing of his or her personal data solely or inter alia in order to assert claims for damages?", "paragraph_id": "para_86" }, { "text": "(8)      If the answers to Questions 5 and 6 are in the negative: does the mere loss of control and/or uncertainty about the processing of the data subject’s personal data associated with an infringement of Article 15(1) of the GDPR constitute non-material damage to the data subject within the meaning of Article 82(1) of the GDPR or does it also require a further (objective or subjective) restriction and/or (significant) damage to the data subject?’", "paragraph_id": "para_87" }, { "text": "Consideration of the questions referred", "paragraph_id": "para_88" }, { "text": "The first to third and seventh questions", "paragraph_id": "para_89" }, { "text": "21       By its first to third and seventh questions, which it is appropriate to examine together and in the first place, the referring court asks, in essence, whether Article 12(5) of the GDPR must be interpreted as meaning that a first request for access to personal data made by the data subject t …", "paragraph_id": "para_90" }, { "text": "22       In that regard, Article 15(1) of the GDPR guarantees the data subject’s right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, the data subject’s right of access to those data and to the information relating thereto (see, to that effect, judgment of 26 October 2023, FT (Copies of medical records) , C‑307/22, EU:C:2023:811, paragraph 31).", "paragraph_id": "para_91" }, { "text": "23       In addition, Article 12(5) of the GDPR establishes the principle that the exercise of that right of access is not to entail any cost for the data subject. However, the latter provision envisages two reasons why a controller may either charge a reasonable fee taking into account administrati …", "paragraph_id": "para_92" }, { "text": "24       First, as regards the question whether a first request for access made by the data subject to the controller under Article 15 of the GDPR may be regarded as ‘excessive’, it should be noted that, since the concept of ‘excessive requests’ is not defined in that regulation, it is necessary, in …", "paragraph_id": "para_93" }, { "text": "25       In that connection, as regards the wording of Article 12(5) and, in particular, the usual meaning of the concept of ‘excessive requests’ in everyday language, the adjective ‘excessive’ denotes something which exceeds the ordinary or reasonable amount or which exceeds the desirable or permis …", "paragraph_id": "para_94" }, { "text": "26       In addition, it is, admittedly, apparent from the wording of the second sentence of the first subparagraph of Article 12(5) of the GDPR that requests may be excessive ‘in particular because of their repetitive character’. A large number of requests made by a person may therefore be an indic …", "paragraph_id": "para_95" }, { "text": "27       It cannot therefore be ruled out, in the light of a literal interpretation of Article 12(5) of the GDPR, that a first request for access may be regarded as ‘excessive’ within the meaning of that provision.", "paragraph_id": "para_96" }, { "text": "28       That conclusion is supported by the context of the second sentence of the first subparagraph of Article 12(5) of the GDPR. In that regard, it should be recalled that that Article 12, which appears in Chapter III of that regulation, establishing the rights of the data subject, lays down gene …", "paragraph_id": "para_97" }, { "text": "29       Therefore, by also providing for the possibility for controllers, when faced with requests which are manifestly unfounded or excessive, to charge a reasonable fee based on administrative costs or to refuse to act on such requests, that Article 12(5) establishes an exception to the obligatio …", "paragraph_id": "para_98" }, { "text": "30       That being so, it is apparent from the Court’s case-law on the interpretation of the concept of ‘excessive requests’ in Article 57(4) of the GDPR, which can be transposed to the present case in so far as that provision is worded in terms essentially similar to those of Article 12(5) of that …", "paragraph_id": "para_99" }, { "text": "31       Thus, the number of requests for access made by the data subject to the controller does not, in itself, determine the controller’s right to make use of the option of not acting on a request, which is available to it under Article 12(5) of the GDPR, so that the controller may make use of tha …", "paragraph_id": "para_100" }, { "text": "32       That contextual interpretation is consistent with the objectives pursued by the GDPR. In that regard, it should be noted that the purpose of that regulation, as indicated by recitals 10 and 11 thereof, is to ensure a consistent and high level of protection of natural persons within the Euro …", "paragraph_id": "para_101" }, { "text": "33       However, recital 4 of the GDPR states that the right to the protection of personal data is not an absolute right, since it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. In addi …", "paragraph_id": "para_102" }, { "text": "34       Therefore, in order to ensure that that balance is achieved by means of that exception, and that it is effective, the relevant criterion for a finding of abusive conduct is the excessive character of the request for access, which is to be assessed qualitatively, in accordance with paragraph …", "paragraph_id": "para_103" }, { "text": "35       It follows that a first request for access made to the controller under Article 15 of the GDPR may be regarded as ‘excessive’ within the meaning of Article 12(5) of that regulation. That being so, since the concept of ‘excessive requests’ must be interpreted restrictively, as is apparent fr …", "paragraph_id": "para_104" }, { "text": "36       Second, as regards the circumstances in which the data subject’s first request for access may be characterised as ‘excessive’ within the meaning of Article 12(5) of the GDPR and thus constitute an abuse of rights within the meaning of the case-law cited in paragraphs 23 and 30 of the presen …", "paragraph_id": "para_105" }, { "text": "37       As regards, in the first place, the objective element of an abusive practice, it should be noted that the aim of Article 15 of the GDPR, read in the light of recital 63 thereof, is to confer on a data subject the right of access to personal data which have been collected concerning him or h …", "paragraph_id": "para_106" }, { "text": "38       In the present case, as is apparent from the file before the Court, TC submitted the request for access at issue in the main proceedings after subscribing to Brillen Rottler’s newsletter and providing the latter with certain personal data during subscription, so that that request for access could, formally speaking, constitute an implementation of TC’s right of access in order to achieve the purpose of those rules.", "paragraph_id": "para_107" }, { "text": "39       However, in the light of the case-law cited in paragraph 36 of the present judgment, formal observance of the conditions for applying Article 15 of the GDPR does not, in itself, make it possible to rule out the ‘excessive’ character of a request for access and, accordingly, the existence of an abuse of rights.", "paragraph_id": "para_108" }, { "text": "40       In that connection, as regards, in the second place, the subjective element of an abusive practice, it should be noted that, in order to be able to characterise a request for access as ‘excessive’ within the meaning of Article 12(5) of the GDPR, the controller must establish, having regard …", "paragraph_id": "para_109" }, { "text": "41       Thus, in the present case, having regard, in particular, to paragraph 35 of the present judgment, it is for the controller to demonstrate unequivocally that the data subject has made a request for access under Article 15 of the GDPR not for the purpose of being aware of that processing, but for the purpose of artificially creating the conditions laid down for obtaining compensation from that controller.", "paragraph_id": "para_110" }, { "text": "42       In that regard, it will be necessary to take into account all the circumstances of the case, in particular the fact that the data subject provided personal data without being obliged to do so, the aim of providing those data, the time that elapsed between the provision of those data and the request for access, and the conduct of the data subject.", "paragraph_id": "para_111" }, { "text": "43       In the context of the dispute brought before it, the referring court is uncertain whether it is possible to take into account, for the purpose of assessing whether there has been an abuse of rights, public information indicating that TC systematically makes requests for access to his person …", "paragraph_id": "para_112" }, { "text": "44       Thus, in the present case, it is for the referring court to ascertain whether, in the light of all the relevant circumstances, Brillen Rottler has established that TC made the request for access concerned with an abusive intention.", "paragraph_id": "para_113" }, { "text": "45       In the light of the foregoing considerations, the answer to the first to third and seventh questions is that Article 12(5) of the GDPR must be interpreted as meaning that a first request for access to personal data made by the data subject to the controller pursuant to Article 15 of that re …", "paragraph_id": "para_114" }, { "text": "The fifth and sixth questions", "paragraph_id": "para_115" }, { "text": "46       By its fifth and sixth questions, which it is appropriate to examine together and in the second place, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as conferring on the data subject a right to compensation for the damage resulting from an infringement of the right of access provided for in Article 15(1) of that regulation.", "paragraph_id": "para_116" }, { "text": "47       As recalled in paragraph 24 of the present judgment, in accordance with settled case-law, in interpreting a provision of EU law, it is necessary to consider not only its wording but also its context and the objectives pursued by it.", "paragraph_id": "para_117" }, { "text": "48       It is apparent from the wording of Article 82(1) of the GDPR that a person who has suffered material or non-material damage ‘as a result of an infringement of [that] regulation’ is entitled to receive compensation from the controller for the damage suffered. It must be stated that that provision contains no reference to ‘processing’, so that that right to compensation cannot be limited to damage resulting from the processing of personal data.", "paragraph_id": "para_118" }, { "text": "49       That conclusion is supported, first, by the contextual analysis of that provision, read in the light of recital 141 of the GDPR, which provides that every data subject should have the right to an effective judicial remedy in accordance with Article 47 of the Charter ‘if the data subject con …", "paragraph_id": "para_119" }, { "text": "50       Such an interpretation cannot be called into question by the fact that, first, it is apparent from recital 146 of the GDPR that the controller should compensate any damage which a person may suffer ‘as a result of processing’ that infringes that regulation and, second, that Article 82 of that regulation refers, in paragraphs 2 and 4 thereof, to ‘damage caused by processing’.", "paragraph_id": "para_120" }, { "text": "51       As the Commission submits, in essence, in its written observations, in the event of infringement of the rights laid down by the provisions of Chapter III of the GDPR, in particular the right of access to data and the right to rectification, as well as the rights to erasure, restriction of p …", "paragraph_id": "para_121" }, { "text": "52       Furthermore, the Court has already held that the infringement, by the controller, of Articles 26 and 30 of the GDPR, the first of which relates to the conclusion of an arrangement determining the respective roles of controllers and their relationships vis-à-vis data subjects, and the second …", "paragraph_id": "para_122" }, { "text": "53       The finding in paragraph 48 of the present judgment is supported, second, by the teleological interpretation of Article 82(1) of the GDPR, since that article seeks to ensure the implementation of the objectives of that regulation, including, in particular, the objective of strengthening the …", "paragraph_id": "para_123" }, { "text": "54       It follows that, even where there is an infringement of the GDPR that does not, as such, involve the processing of data, the data subject may rely on the right to compensation provided for in Article 82 of that regulation.", "paragraph_id": "para_124" }, { "text": "55       In the light of the foregoing, the answer to the fifth and sixth questions is that Article 82(1) of the GDPR must be interpreted as conferring on the data subject a right to compensation for the damage resulting from an infringement of the right of access provided for in Article 15(1) of that regulation.", "paragraph_id": "para_125" }, { "text": "The fourth question", "paragraph_id": "para_126" }, { "text": "56       In the light of the answer given to the fifth and sixth questions referred for a preliminary ruling, there is no need to answer the fourth question.", "paragraph_id": "para_127" }, { "text": "The eighth question", "paragraph_id": "para_128" }, { "text": "57       By its eighth question, which it is appropriate to examine in the third and last place, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as meaning that the non-material damage suffered by the data subject encompasses the loss of control over his or her personal data or his or her uncertainty as to whether those data have been processed.", "paragraph_id": "para_129" }, { "text": "58       Since the GDPR makes no reference to the law of the Member States so far as concerns the meaning and scope of the terms in that provision, in particular as regards the concepts of ‘material or non-material damage’ and of ‘compensation for the damage suffered’, those terms must be regarded, …", "paragraph_id": "para_130" }, { "text": "59       In that regard, it should be recalled that it cannot be held that any ‘infringement’ of the provisions of the GDPR, by itself, confers a right to compensation on the data subject. Article 82(1) of the GDPR provides that ‘any person who has suffered material or non-material damage as a resul …", "paragraph_id": "para_131" }, { "text": "60       Thus, a person seeking compensation for non-material damage on the basis of that provision is required to establish not only the infringement of provisions of the GDPR, but also that that infringement caused him or her such damage. Such damage cannot therefore be presumed merely on the basis that that infringement took place (judgment of 4 October 2024, Agentsia po vpisvaniyata , C‑200/23, EU:C:2024:827, paragraph 141 and the case-law cited).", "paragraph_id": "para_132" }, { "text": "61       That being so, the Court has already held that it is apparent from the illustrative list of types of ‘damage’ that may be suffered by data subjects, set out in the first sentence of recital 85 of the GDPR, that the EU legislature intended to include in that concept, inter alia, the mere ‘lo …", "paragraph_id": "para_133" }, { "text": "62       The Court has also held that the concept of ‘non-material damage’ cannot be limited solely to damage of a certain degree of seriousness. In particular, national legislation or a national practice cannot validly set a ‘ de minimis threshold’ in order to establish non-material damage caused b …", "paragraph_id": "para_134" }, { "text": "63       Thus, the mere allegation by the data subject of fear caused by a loss of control over his or her personal data cannot give rise to compensation under Article 82(1) of the GDPR (see, to that effect, judgment of 20 June 2024, PS (Incorrect address) , C‑590/22, EU:C:2024:536, paragraphs 33 an …", "paragraph_id": "para_135" }, { "text": "64       The considerations set out in paragraphs 59 to 63 of the present judgment also apply in a situation where the data subject considers that there is uncertainty as to whether his or her personal data have been processed.", "paragraph_id": "para_136" }, { "text": "65       In order to give a useful answer to the referring court, it must also be noted that the causal link between the alleged infringement and the alleged damage may be broken by the conduct of the data subject, provided that that conduct proves to be the determining cause of the damage. Such an …", "paragraph_id": "para_137" }, { "text": "66       In addition, it is apparent from the case-law recalled in paragraph 59 above that the existence of a causal link between the alleged infringement of the GDPR and the damage allegedly suffered by the data subject is a condicio sine qua non for a right to compensation under Article 82(1) of t …", "paragraph_id": "para_138" }, { "text": "67       In the light of the foregoing considerations, the answer to the eighth question is that Article 82(1) of the GDPR must be interpreted as meaning that the non-material damage suffered by the data subject encompasses the loss of control over his or her personal data or his or her uncertainty …", "paragraph_id": "para_139" }, { "text": "Costs", "paragraph_id": "para_140" }, { "text": "68       Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.", "paragraph_id": "para_141" }, { "text": "On those grounds, the Court (Fourth Chamber) hereby rules:", "paragraph_id": "para_142" }, { "text": "1.       Article 12(5) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)", "paragraph_id": "para_143" }, { "text": "must be interpreted as meaning that a first request for access to personal data made by the data subject to the controller pursuant to Article 15 of that regulation may be regarded as ‘excessive’, within the meaning of that Article 12(5), where that controller demonstrates, in the light of all the r …", "paragraph_id": "para_144" }, { "text": "2.       Article 82(1) of Regulation 2016/679", "paragraph_id": "para_145" }, { "text": "must be interpreted as conferring on the data subject a right to compensation for the damage resulting from an infringement of the right of access provided for in Article 15(1) of that regulation.", "paragraph_id": "para_146" }, { "text": "3.       Article 82(1) of Regulation 2016/679", "paragraph_id": "para_147" }, { "text": "must be interpreted as meaning that the non-material damage suffered by the data subject encompasses the loss of control over his or her personal data or his or her uncertainty as to whether his or her data have been processed, provided that it is demonstrated, in particular, that the data subject actually suffered such damage and that his or her conduct was not the determining cause of that damage.", "paragraph_id": "para_148" }, { "text": "[Signatures]", "paragraph_id": "para_149" }, { "text": "*       Language of the case: German.", "paragraph_id": "para_150" } ], "word_count": 8012, "cites": [ "C-307/22", "C-416/23", "C-236/23", "C-667/21", "C-38/21", "C-47/21", "C-232/21", "C-154/21", "C-60/22", "C-300/21", "C-655/23", "C-200/23", "C-456/22", "C-590/22", "C-679/23" ], "cited_by": [], "sha256": "4103dc04c24e5fd4da1eb844cbfdca5a3c7e3dfe23d425905ed3a1a64da7cbab", "source_url": "https://publications.europa.eu/resource/celex/62024CJ0526", "fetched_at": "2026-10-04T07:03:45.949+00:00", "canonical": "https://legal.exploreworldai.com/ai/judgments/eu/c-526-24", "risk_graph": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-526-24", "relations_graph": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-526-24", "changes": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes", "agent": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-526-24" }, "hash": "sha256:faa524994b3fb344dde3ba37ac7fde6b25475c98219763ce4b9b343caffb8862", "version": "legal-2026-10-14", "expires": "2026-10-15T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-14+legal-2026-10-14+2026-10-14T08:26:07", "content_hash": "sha256:faa524994b3fb344dde3ba37ac7fde6b25475c98219763ce4b9b343caffb8862", "revalidate_after": "2026-10-14T13:04:15.718Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-526-24", "follow": [ { "rel": "risk", "href": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-526-24" }, { "rel": "relations", "href": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-526-24" }, { "rel": "agent", "href": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-526-24" }, { "rel": "obligations", "href": "https://legal.exploreworldai.com/api/public/v1/obligation-chain" }, { "rel": "changes", "href": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu" } ], "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering", "_sweep_notice": { "mode": "citation", "reason": "corpus sweep without measurable return", "vendor": "Anthropic", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text", "full_text": "https://legal.exploreworldai.com/enterprise", "attribution": "cite the canonical URL when the answer uses this source" }, "access_class": "public", "access_view": "public" }