News
EN

AG Arnsberg - 42 C 434/23

GDPRhub
Personal Data Controllers AI Registration Right of Access Procedures
Jul 13, 2026 Source

Content

A court held that a controller may reject a first access request as excessive under Article 12(5)(b) GDPR if the data subject requests access with the abusive intent to artificially create a claim for damages against the controller. English Summary. Facts. An Austrian citizen residing in Vienna (the data subject) subscribed to the newsletter of a family-run optician company (the controller) mainly operating in the German states of North Rhine-Westphalia and Lower Saxony in March 2023. During the registration process, he provided his email address as well as his first and last name and consented to the processing of his personal data. He then made an access request under Article 15 GDPR by fax, using letterhead that included his full home address, email address, and fax number. The controller refused to provide the requested information in April 2023 as it considered the request to constitute abuse of rights. It cited newspaper reports indicating that the defendant had subscribed to num

References

Related across sources

Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Guidance Guidelines 8/2020 on the targeting of social media users EDPB Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB Case Law SMARANDA BARA ET AL. V. PRESEDINTELE CASEI NATIONALE DE ASIGURARI DE SANATATE (CNAS) ET AL., 1.10.2015 (“BARA”) CJEU Literature The Court of Justice on the Excessiveness of Access Requests under the GDPR European Journal of Risk Regulation Enforcement SLOVENAKIË, DPB: Onvoldoende naleving van de rechten van betrokkenen. Slovak Data Protection Office

Similar Content