{"id":43573,"date":"2026-03-19T18:15:14","date_gmt":"2026-03-19T16:15:14","guid":{"rendered":"https:\/\/2b-advice.com\/?p=43573"},"modified":"2026-04-14T14:52:12","modified_gmt":"2026-04-14T12:52:12","slug":"when-is-a-request-for-information-excessive-eugh-names-specific-points-for-examination","status":"publish","type":"post","link":"https:\/\/2b-advice.com\/en\/2026\/03\/19\/wann-ist-ein-auskunftsersuchen-exzessiv-eugh-nennt-konkrete-pruefpunkte\/","title":{"rendered":"When is a request for information excessive? ECJ names specific test points"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\n\t\t\t\t\t\"Picture\n\t\t\t\t<\/a>\n\t\t\t\n\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t

\n\t\t\t\t\t\t\t Aristotelis Zervos\t\t\t\t\t\t<\/h4>\n\t\t\t\t\t<\/a>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Aristotelis Zervos, Editorial Director at 2B Advice, combines legal and journalistic expertise in Data protection<\/a>IT compliance and AI regulation.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

With the \u201eBrillen Rottler\u201c decision, the ECJ has specified the limits of the right of access under Art. 15 GDPR and at the same time sharpened the contours of the right to compensation under EU law in accordance with Art. 82 GDPR. According to the ECJ, even a first request for information can be \u201eexcessive\u201c within the meaning of Art. 12 para. 5 GDPR if the controller proves that the request does not serve to control data processing, but is made abusively to artificially create claims for damages.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Request for information is rejected due to excess<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In practice, the right to information under Art. 15 GDPR is one of the most important rights of data subjects. However, they regularly present an area of conflict for data controllers. On the one hand, the right of access is a key transparency instrument and a prerequisite for the effective exercise of other data subject rights. On the other hand, there is an increasing number of constellations in which requests for information are obviously not primarily aimed at transparency, but at generating pressure, costs or claims for damages.<\/p>

The ECJ now had to decide on a referral from the Arnsberg District Court. The data subject had subscribed to an optician's newsletter and entered personal data in the online form. Just 13 days later, she submitted a request for information in accordance with Art. 15 GDPR. The company Brillen Rottler rejected the request as it was abusive. It was apparent from various media reports, blog posts and reports by lawyers that the applicant was systematically registering for newsletters from various companies, then requesting information and finally demanding compensation. The person concerned, on the other hand, considered their request to be legitimate and demanded at least 1,000 euros in non-material damages for the refusal to provide information.<\/p>

The Court thus had to answer two highly relevant questions in practice: Under what conditions may a request for information be rejected as excessive and abusive? And can the violation of the right of access as such justify a claim for damages under Art. 82 GDPR? <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

First request for information can be excessive<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The first key finding of the ECJ is that a request for information does not have to be made repeatedly in order to be considered excessive within the meaning of Art. 12 (5) GDPR. Although the standard explicitly mentions \u201efrequent repetition\u201c, this is only by way of example. The Court therefore rejects any schematic view according to which an initial request can never be conceptually excessive.<\/p>

The ECJ's decision is based on the wording and system of the GDPR. In common parlance, the term \u201eexcessive\u201c describes behavior that goes beyond what is reasonable or permissible. However, this does not mean that only quantitative excesses can be meant. A qualitatively abusive application can also be excessive. At the same time, the Court emphasizes that Art. 12 para. 5 GDPR must be interpreted narrowly as an exception to the fundamental free and facilitated exercise of data subjects' rights. High standards therefore apply to the assumption of an excessive initial request.<\/p>

For practical purposes, it is particularly important that the ECJ classifies Art. 12 (5) GDPR within the general principle of abuse under EU law. Data subjects' rights may not be exploited in a fraudulent or abusive manner. The ruling thus strengthens those responsible where applications are clearly not used for data protection control, but for the formulaic production of claims.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Proof of intent to abuse required<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The Court of Justice requires an overall assessment of all relevant circumstances for the assumption of an abusive excessive request. The decisive factor is whether the request actually serves the purpose of Art. 15 GDPR, namely to raise awareness of the processing and to verify its lawfulness. If this purpose is lacking and the aim is instead to artificially create the conditions for a financial advantage from the GDPR, this may constitute abuse.<\/p>

The ECJ mentions several circumstances that can be included in this assessment:<\/p>