Brillen-Rottler Judgment: recognising abuse of access requests

Is Brillen-Rottler truly nothing new, as some appear to be suggesting? This new judgment of the EU Court of Justice confirms that data subject access requests made with a demonstrable aim of obtaining an advantage other than the gaining of awareness about the processing of personal data can be rejected as abusive.

Given the number of cases in which data protection authorities have dismissed arguments by controllers that requests were made with an ulterior motive, I do not think that this judgment is pure legal theory or nothing new.

I have been arguing in favour of recognising the abuse of rights doctrine in relation to data subject requests for a while, and I have helped several clients use that justification to reject abusive requests in the past. So for me, it might not be a novel position, but for certain authorities and courts, it most definitely is.

As mentioned in my overview of the reasoning of the Court, the judgment is not an excuse for blanket refusals and a case-by-case assessment is always needed.

But it does seriously bring into question any “artificial” requests, to borrow a word from the judgment. Incentivised requests for the purposes of class actions come to mind, but there are many others.

An ex-employee with no interest in the processing but aiming to harm the former employer?
The employee of a competitor seeking information with a view to using it to harm the company or to harness a competitive advantage?
The person or organization scouring websites never visited before in order to be able to file a complaint?

These now all appear to be more disputable.

The key lesson is that, just as Recital 4 of the GDPR says, the right to data protection is not absolute. In practice, the misuse of data subject rights dilutes them.

A legitimate request must be honoured, an illegitimate one not.

Key excerpts from the judgment: https://lnkd.in/e8JJAsN5

privacy