Aristotelis Zervos
Aristotelis Zervos, Editorial Director at 2B Advice, combines legal and journalistic expertise in Data protection, IT-Compliance and AI regulation.
In the „Brillen Rottler“ decision, the ECJ clarified the limits of the right to information under Art. 15 GDPR and, at the same time, the contours of compensation under EU law in accordance with Art. 82 GDPR sharpened. According to the ECJ, even a first-time request for information can be „excessive“ within the meaning of Art. 12 para. 5 GDPR be, if the Responsible persons demonstrates that the request is not intended to monitor data processing, but is being made in bad faith to artificially create claims for damages.
Request for Information Rejected Due to Excess
In practice, claims for information under Art. 15 GDPR to the most important rights of data subjects. For Responsible persons However, they regularly present a conflict of interests. On the one hand, the Right to information a key transparency tool and a prerequisite for the effective exercise of further Rights of data subjects. On the other hand, there is an increasing number of constellations in which requests for information are obviously not primarily based on Transparency, but to generate pressure, costs or claims for damages.
The ECJ now had to decide on a referral from the Arnsberg District Court. The affected person had subscribed to the newsletter of an optician's company and in doing so personal data in the online form. Just 13 days later, she submitted a request for information in accordance with Art. 15 GDPR. The company Brillen Rottler rejected the request as it was abusive. It was apparent from various media reports, blog posts and reports from lawyers that the applicant systematically registered for newsletters from various companies, then requested information and finally demanded compensation. The affected Person, on the other hand, considered her application to be legitimate and demanded at least 1,000 euros in non-material damages for the refusal to provide information.
The Court thus had to answer two highly relevant practical questions: Under what conditions may a request for information be rejected as excessive and abusive? And can the violation of the right to information as such give rise to a claim for damages under Art. 82 GDPR justify?
First request for information can be excessive
The central first finding of the ECJ is that a request for information does not have to have been made repeatedly in order to be considered excessive within the meaning of Art. 12(5) of the GDPR. GDPR to apply. Although the standard explicitly mentions „frequent repetition“, this is only by way of example. The Court therefore rejects any schematic view according to which a first application can never be conceptually excessive.
With its decision, the ECJ ties in with the wording and system of the GDPR an. In common parlance, the term „excessive“ describes behavior that exceeds what is reasonable or permissible. However, this does not mean that only quantitative excesses can be meant. A qualitatively abusive application can also be excessive. At the same time, the Court emphasizes that Art. 12 para. 5 GDPR as an exception to the fundamental free and facilitated exercise of the Rights of data subjects must be interpreted narrowly. Therefore, high standards apply to the determination of whether an initial application is excessive.
For practical purposes, it is particularly important that the ECJ has ruled that Art. 12 para. 5 GDPR into the general principle of abuse under EU law. Rights of data subjects must not be exploited in a fraudulent or abusive manner. In this way, the ruling strengthens the position of those responsible in cases where requests are clearly intended not to serve data protection oversight but rather to generate claims in a formulaic manner.
Proof of intent to abuse required
The Court of Justice requires an overall assessment of all relevant circumstances for the assumption of an abusive excessive application. The decisive factor is whether the application actually serves the purpose of Art. 15 GDPR namely to raise awareness of the Processing and the review of their legality. If this purpose is missing and the aim is instead to artificially create the conditions for a financial benefit from the GDPR to create a new job, this may constitute misuse.
The ECJ identifies several factors that may be taken into account in this assessment:
- the voluntary provision of data,
- the purpose of this provision,
- the short time interval between the provision of data and the request for information and
- the overall behavior of the person concerned.
It should be particularly emphasized that publicly available information on a systematic approach may also be taken into account. However, such information is not sufficient in isolation. It can be an indication, but must be confirmed by other circumstances. This also corresponds to the exceptional nature of Art. 12 para. 5 GDPR. According to the ECJ, a first application may be abusive if it is not subject to the control of the Processing, but serves solely to create the conditions for compensation. Several similar cases can be an indication of this.
Compensation under Art. 82 GDPR also in the event of a breach of the right of access
The second part of the decision is equally important. The ECJ clarifies that Art. 82 para. 1 GDPR is not limited to damages resulting directly from data processing. A claim for damages can therefore also arise from the violation of the right to information pursuant to Art. 15 para. 1 GDPR are created.
The Court thus rejects a narrow, purely processing-related interpretation of Art. 82 GDPR back. The GDPR not only protects against unlawful Processing, but also grants independent Rights of data subjects, whose effective enforcement must be secured under EU law. If Art. 82 GDPR to cases of direct Processing the protection of these rights would be partially invalidated. A claim for damages can therefore also be asserted in the event of a breach of the right to information about personal data exist.
No automatism: Infringement alone is not enough
However, the ECJ also makes it clear that not every Infringement against the GDPR automatically leads to a claim for damages. The three known requirements are still necessary.
- Infringement against the GDPR,
- actual tangible or intangible damage, and
- Causal link between Infringement and damage.
This is precisely where the balancing function of the decision lies. The Court of Justice extends Art. 82 GDPR is not unlimited. It does confirm that the violation of the right to information can also be relevant to liability. At the same time, however, it remains the case that the affected person must demonstrate and prove real damage. An abstract violation of the law is not sufficient. This corresponds to the previous line of the ECJ on Art. 82 GDPR.
Loss of control and uncertainty as immaterial damage
With regard to non-pecuniary damages, the Court acknowledges that the loss of control over personal data or whether the uncertainty as to whether data was processed can, in principle, constitute compensable non-pecuniary damage. It is precisely this Right to information aims to eliminate information asymmetries and give those affected control over their data.
However, the ECJ takes a nuanced approach here as well. Merely asserting a fear is not sufficient. It must be proven that a non-material disadvantage actually occurred. Furthermore, the causal link may be broken if the affected person’s own conduct was the decisive cause of the alleged harm.
Therefore, anyone who knowingly provides data with the intent of subsequently creating the conditions for a claim for damages cannot simply invoke a loss of control that was created as a result.
Reading tip: BAG: “Annoyance” Over Delayed Disclosure Is Not Sufficient Grounds for Damages
Implications of the "Brillen Rottler" Decision for Practice
The decision is neither a „free pass” to reject inconvenient requests for information nor an invitation to file strategic mass requests. Rather, it represents a middle ground that strikes a balance under EU law.
For Responsible persons this initially means that the hurdles for assuming an excessive initial application remain high. A blanket reference to abuse is not permissible. Anyone who submits an application pursuant to Art. 12 para. 5 GDPR If the employer wishes to reject the application, he must be able to document in a comprehensible manner the specific circumstances that indicate that the Affected parties not the legality of the Processing wants to examine. Mere assumptions, general skepticism or a conflict-oriented pursuit of claims are not sufficient.
At the same time, the ruling strengthens the options for defense in cases involving potential abuse. In cases where the circumstances appear suspicious, one should Responsible persons Conduct a structured abuse review. Relevant indicators may include: an extremely short time interval between data entry and a request for information; contact patterns that appear to have been artificially created; parallel patterns of claims directed at numerous data controllers; and public indications of a standardized approach. However, the overall picture always remains the decisive factor.
For processing practice, the ruling also means that rejections must be justified with particular care. Who Art. 12 para. 5 GDPR bears the burden of presentation and proof. For this reason alone, a documented case-by-case review involving the data protection and legal department is recommended on a regular basis.
From the perspective of those affected, the ruling also sets clear boundaries. Judicial enforcement of the right to information remains legitimate. Nor is the assertion of claims for damages abusive per se. However, abuse occurs only when the Right to information is used contrary to its function. In other words, it no longer meets the protective purpose of Art. 15 GDPR but is merely used as a vehicle for the artificial generation of claims.
Source: ECJ Decision “Brillen Rottler” (C‑526/24 of March 19, 2026)
Aristotelis Zervos is Editorial Director at 2B Advice, a lawyer and journalist with profound expertise in data protection, GDPR, IT-Compliance and AI governance. He regularly publishes in-depth articles on AI regulation, GDPR-Compliance and risk management. You can learn more about him on his Author profile page.
German 
English 
Italian 
French