Firms can refuse GDPR access requests only if abusive, EU court opinion says

By Júlia Tar ( September 18, 2025, 10:37 GMT | Insight) -- Companies may refuse an access request under the EU's General Data Protection Regulation only if they can prove the data subject acted abusively, Advocate General Maciej Szpunar said in his opinion on Thursday. The opinion said that abuse may exist where an individual deliberately consents to data use in order to trigger an access request and claim damages. Szpunar also said that even a first request can be considered excessive, but only in exceptional cases, and that a record of repeated claims alone is not enough to justify refusal.Companies can refuse an access request under the EU's General Data Protection Regulation only if they can prove the request was abusive, Maciej Szpunar, the Advocate General of the Court of Justice of the EU, said on Thursday in his opinion (see here)....

Prepare for tomorrow’s regulatory change, today

MLex identifies risk to business wherever it emerges, with specialist reporters across the globe providing exclusive news and deep-dive analysis on the proposals, probes, enforcement actions and rulings that matter to your organization and clients, now and in the longer term.

Know what others in the room don’t, with features including:

Daily newsletters for Antitrust, M&A, Trade, Data Privacy & Security, Technology, AI and more
Custom alerts on specific filters including geographies, industries, topics and companies to suit your practice needs
Predictive analysis from expert journalists across North America, the UK and Europe, Latin America and Asia-Pacific
Curated case files bringing together news, analysis and source documents in a single timeline

Experience MLex today with a 14-day free trial.

Start Free Trial

Already a subscriber? Click here to login

Firms can refuse GDPR access requests only if abusive, EU court opinion says

Prepare for tomorrow’s regulatory change, today

Related Sections