The CJEU has recently released a judgment in relation to rejecting a DSAR, adding further guidance on when it might be possible to reject a DSAR on the grounds it is “excessive”.
Background: An individual subscribed to a newsletter and made a DSAR 13 days later. The company rejected the DSAR on the grounds it was abusive saying that there was evidence this individual had a habit of doing this followed by making a compensation claim.
The question referred to CJEU: The local court which heard the claim asked the CJEU if a first request can be “excessive” and whether an individual can claim compensation for denial of the request.
The ruling: The CJEU held that a first request can be excessive if it is made with the abusive intent of artificially creating the conditions to obtain an advantage from the GDPR, considering the circumstances, which here included the individual’s motivation in providing his personal data, and evidence of his previous actions. The court also confirmed that compensation is possible, but the individual must show that damage was suffered and that the individual’s conduct must not be the cause of the damage (e.g. where there is abusive intent behind the provision of the information in the first place).
This case doesn’t lower the bar for rejecting an “excessive” DSAR, but gives some more guidance on when this might be possible and highlights the importance of building a picture of the individual’s behaviour and evidence of their motivations to justify a rejection.
Access to the judgment can be found here.
