CJEU Case C-526/24 / Judgment

Key facts of the case:

Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 12(5) – Article 15(1) – Data subject’s right of access to the personal data concerning him or her – Controller’s right to refuse to act on the request for access – Excessive character of the request – Abuse of rights – First request for access – Right to compensation and liability – Article 82(1) – Action based on infringement of the right of access – Non-material damage – Loss of control over personal data.

Outcome of the case:

On those grounds, the Court (Fourth Chamber) hereby rules:

1. Article 12(5) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

   must be interpreted as meaning that a first request for access to personal data made by the data subject to the controller pursuant to Article 15 of that regulation may be regarded as ‘excessive’, within the meaning of that Article 12(5), where that controller demonstrates, in the light of all the relevant circumstances of the case, that, despite formal observance of the conditions laid down by those provisions, that request was made by the data subject not for the purpose of being aware of the processing of those data and verifying the lawfulness of that processing, in order to be able, subsequently, to obtain protection of his or her rights under that regulation, but with an abusive intention, such as that of artificially creating the conditions laid down for obtaining an advantage from that regulation. The fact that, according to publicly available information, the data subject has made a large number of requests for access to his or her personal data, followed by claims for compensation, to various controllers, may be taken into consideration for the purpose of establishing the existence of such an abusive intention.

2. Article 82(1) of Regulation 2016/679

   must be interpreted as conferring on the data subject a right to compensation for the damage resulting from an infringement of the right of access provided for in Article 15(1) of that regulation.

3. Article 82(1) of Regulation 2016/679

   must be interpreted as meaning that the non-material damage suffered by the data subject encompasses the loss of control over his or her personal data or his or her uncertainty as to whether his or her data have been processed, provided that it is demonstrated, in particular, that the data subject actually suffered such damage and that his or her conduct was not the determining cause of that damage.