Brillen Rottler GmbH & Co. KG – Court Ruling (Germany, 2026)

An Austrian citizen residing in Vienna (the data subject) subscribed to the newsletter of a family-run optician company (the controller) mainly operating in the German states of North Rhine-Westphalia and Lower Saxony in March 2023. During the registration process, he provided his email address as well as his first and last name and consented to the processing of his personal data. He then made an access request under Article 15 GDPR by fax, using letterhead that included his full home address, email address, and fax number. The controller refused to provide the requested information in April 2023 as it considered the request to constitute abuse of rights. It cited newspaper reports indicating that the defendant had subscribed to numerous newsletters solely for the purpose of asserting claims for damages. The controller brought proceedings concerning the legality of its rejection of the access request. The data subject demanded access to the information required by in Article 15 GDPR and the payment of monetary compensation of €1,000 in a counter-lawsuit. The court referred the case to the CJEU for a preliminary ruling in July 2024. The CJEU rendered its judgment in the case C-526/24 Brillen Rottler on 19 March 2026. It held that even an initial access request could be rejected on the grounds of an abuse of rights. According to the CJEU, the assessment of abusive conduct is based on all circumstances of the individual case. Both objective circumstances and the subjective intent of the data subject need to be taken into account. An abusive intent always exists if the access request is made in order to artificially create a claim for damages. The court held that the lawsuit had originally been well-founded and ruled that the counterclaims were without merit. According to the court, the controller could reject the data subject’s access request as excessive under Article 12(5)(b) GDPR. The data subject also had no right to damages under Article 82 GDPR due to the absence of a GDPR violation. The court referred to the preliminary ruling in the case C-526/24 and based its decision on an overall assessment of the objective and subjective circumstances of the present case as required by the CJEU decision. It held that the data subject’s conduct had been abusive. To the conviction of the court, there were numerous indications of abusive conduct: first, the data subject had voluntarily disclosed more personal data than was needed to subscribe to the newsletter. Second, the court could not identify any personal interest in a regional newsletter concerning operations in Nordrhein-Westfalen, as the data subject was an Austrian resident. In addition, the court took into account that the data subject had made the access request only nine days after subscribing to the newsletter and had not filed a complaint with the competent DPA before raising a claim for damages. Finally, information on the internet about numerous cease-and-desist letters sent by the data subject pointed to abusive conduct.