When a GDPR Access Request Starts Looking Like a Trap
A March 2026 EU court ruling tightens the rules on data access disputes by treating abuse as a question of proof, context, and causal damage - not just timing.
For privacy teams, a request under Article 15 of the GDPR is usually routine. The latest EU court guidance makes that routine look more fragile. In the Brillen Rottler case, the Court of Justice of the European Union is described as drawing a sharper line between a genuine access request and one that may be considered excessive or manifestly unfounded. The key shift is not a denial of the right itself, but a more demanding test for controllers who want to refuse it.
Fast Facts
- A March 2026 judgment identified as Brillen Rottler concerns the GDPR right of access.
- Excessiveness is treated as a qualitative assessment of the surrounding circumstances.
- The controller bears the burden of proving that a request is excessive or manifestly unfounded.
- Compensation under Article 82 GDPR requires proof of actual damage and a causal link.
- The ruling raises the value of documenting the request, the response, and the refusal rationale.
Why this matters beyond one dispute
The practical lesson is that a first request is not automatically safe from scrutiny, but neither is it automatically abusive. The legal test is described as qualitative, meaning the controller has to look at the full context: timing, purpose, prior conduct, and any concrete signs that the request is being used in a way the GDPR does not protect. That is a much narrower and more evidence-driven path than a simple count of how many requests were filed.
From a compliance perspective, that places pressure on recordkeeping. If a controller decides to refuse access or charge a reasonable fee under Article 12(5), it needs a defensible explanation, not a reflex. The case also reinforces a familiar GDPR pattern: rights remain broad, but exceptions are interpreted carefully. In other words, “excessive” is not a label for inconvenience. It is a threshold that must be demonstrated.
The compensation side matters too. Article 82 is not a shortcut to damages. The ruling is described as requiring proof of actual harm and a causal link between the alleged violation and the loss claimed. That distinction matters for organizations trying to separate a privacy request workflow from a potential litigation workflow. They are related, but they are not the same process.
As an operational takeaway, organizations may want to document requests, context, correspondence, and the exact reason for any refusal. That is not because every request is suspicious, but because the burden of proof sits with the controller. A well-kept paper trail can be the difference between a lawful limitation and an unconvincing denial.
At the time of writing, the safest reading is cautious: the ruling does not weaken the GDPR’s access right, but it does give controllers a structured way to challenge requests when they can prove abuse. The broader lesson is simple - in privacy compliance, the ability to explain a decision is now nearly as important as the decision itself.
Conclusion
Brillen Rottler is a reminder that GDPR access rights are not managed by intuition. They are managed by evidence, context, and proportionality. For controllers, the message is clear: if you want to refuse, you must be ready to prove why. For everyone else, the case shows how European privacy law is increasingly built around accountability that can withstand scrutiny.
TECHCROOK
document scanner: A document scanner can help teams archive access requests, refusal letters, timestamps, and supporting correspondence in a searchable record. For compliance work, a simple desktop or portable model is often enough when you need a clean audit trail and quick retrieval of older paperwork. Pair it with consistent file naming and retention rules.
WIKICROOK
- GDPR: The EU data protection regulation that sets rules for processing personal data and individual rights.
- Article 15 GDPR: The right of access that lets a person ask whether their data is being processed and obtain related information.
- Article 12(5) GDPR: The rule that lets a controller refuse or charge for requests that are manifestly unfounded or excessive, if that is proven.
- Article 82 GDPR: The compensation provision covering material or immaterial damage caused by a GDPR violation.
- Burden of proof: The duty to provide evidence supporting a legal claim or defense, here resting on the controller when refusing access.
