Data subject requests: legal criteria for abusive practices

Judgment analysis: when is a data subject request abusive? Today’s judgment of the EU Court of Justice is significant, though its scope cannot be misused either.
 
These excerpts are essential reading for data protection practitioners:
(EDIT: English version now available, quotes updated)
 
Para 27: “It cannot therefore be ruled out […] that a first request for access may be regarded as ‘excessive’ within the meaning of that provision.

28: “since repetitive character is referred to in [Art. 12(5) GDPR] solely by way of example, the characterisation of a request for access as ‘excessive’ does not require that that request necessarily be made in connection with the submission of a large number of requests by the same data subject

30: “[Art. 12(5) GDPR] is expression of the general principle of EU law to the effect that EU law cannot be relied on for abusive or fraudulent ends

31: “the controller may make use [of its right not to accede to a request] even in the case of a first request for access, where it establishes, having regard to all the relevant circumstances of each case, that there has been an abusive intention on the part of that data subject

33: “[R]ecital 4 [GDPR] states that the right to the protection of personal data is not an absolute right, since it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality

36: “[P]roof of an abusive practice requires (i) a combination of objective circumstances in which, despite formal observance of the conditions laid down by the EU rules, the purpose of those rules has not been achieved and (ii) a subjective element consisting in the intention of the data subject to obtain an advantage from the EU rules by artificially creating the conditions laid down for obtaining it”.

40: “A finding of an abusive intention may be made where the data subject has made that request for a purpose other than that of being aware of the processing of those data and verifying the lawfulness of that processing, in order to be able, subsequently, to obtain protection of his or her rights under the GDPR
 
41: The controller must therefore “demonstrate unequivocally that the data subject has made a request for access under Article 15 of the GDPR […] for the purpose of artificially creating the conditions laid down for obtaining compensation from that controller.

Time lapse between data provision & request and data subject behaviour, as well as the objective underlying the request can be examples of relevant circumstances (para. 42).
 
In other words: data protection rights are not absolute and the general theory of abuse of rights applies, also to the GDPR.
 
This is not an open door to blanket refusals, as a justification is needed.
The judgment is proportionate and pragmatic, and I am glad that the Court has gone in this direction.

Link: https://lnkd.in/eAXMuav6