Rydo Telecom – Court Ruling (Netherlands, 2026)

Rydo Telecom (the controller) is a telecommunications provider. In 2023, a data subject made an access request following a dispute with the controller on whether the data subject received two phones they had purchased from the controller. The data subject informed the controller in a letter that they intended to claim costs in the event that it did not respond to the request. The controller began investigating the data subject and found a similar claim against PostNL (one of the controller’s suppliers). According to PostNL, the data subject had made a similar claim that it had failed to deliver the two phones. The data subject later filed a case with the Amsterdam sub district court after the controller refused to respond to the request. The court dismissed the data subject’s claim for reimbursement of €2,908, on the grounds that the data subject had accused both companies of the same issue, and had left the hearing early. The data subject continued to reiterate their access request in 2024, and received a response from the controller in 2025. The controller stated that it no longer had data related to them beyond their email address in connection to the previous lawsuit. The data subject filed a case with the sub district court in 2026, who later referred the case to the court. The data subject requested the court to order the controller to provide full access to their data, subject to a penalty for noncompliance. The court first noted that the data subject had filed approximately 20 GDPR request cases with the sub district court within one year against different controllers. The court then assessed whether the data subject’s request was abusive within the meaning of Article 12(5) GDPR. This includes an objective and subjective element following CJEU case law (Brillen Rottler).See case C‑526/24 (Brillen Rottler), https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62024CJ0526 According to the CJEU, the subjective element requires the data subject to intend to obtain a benefit by artificially creating the conditions to receive said benefit. Publicly available information can be used for this assessment. The court considered that the data subject had abused their right. The court took into consideration other cases the data subject had initiated, and considered that the data subject had a financial motive for their requests rather than a genuine concern to assess their personal data or verify the lawfulness of its processing. The court gave as an example the fact that the data subject had insisted that the controller reach a settlement in the form of paying compensation or damages. The court dismissed the case. Since there was an established abuse of rights, the court saw no need to assess the merits of the data subject’s claim.