In response to questions formulated by the German Amtsgericht of Arnsberg, the ECJ ruled that a first DSAR may be regarded as ‘excessive’, within the meaning of Article 12(5) GDPR, where the data controller demonstrates that, despite formal observance of the conditions governing DSARs, the request was made by the data subject:

  • not for the purpose of being aware of the processing of their data and verifying the lawfulness of that processing in order to be able, subsequently, to obtain protection of their rights under the GDPR (right to rectification, right to erasure or right to restriction of processing, right to object and right of action where the data subject suffers damage),
  • but instead with an abusive intention, such as that of artificially creating the conditions laid down for obtaining an advantage from the GDPR.

The ECJ considers that the meaning of “excessive requests” needs to be interpreted in its “everyday language” and that a first request may thus indeed be excessive. The ECJ confirms that the application of EU legislation cannot be extended to cover transactions carried out for the purpose of fraudulently or wrongfully obtaining advantages provided for by EU law.

Proof of an abusive practice requires:

  • a combination of objective circumstances in which, despite formal observance of the conditions laid down by the EU rules governing DSARs, the purpose of those rules has not been achieved; and
  • a subjective element consisting of the data subject’s intention to obtain an advantage from the EU rules by artificially creating the conditions laid down for obtaining it.

The ECJ emphasizes the importance of the circumstances: it will be necessary to take into account all the circumstances of the case, in particular the fact that the data subject provided personal data without being obliged to do so, the aim behind providing that data, the time that elapsed between the provision of that data and the request for access, and the conduct of the data subject. Therefore, reliance on Article 12(5) GDPR in relation to a first access request must remain exceptional and subject to a strict evidential threshold.

Impact on DSARs in an employment context

So how will this judgment impact the trend we are seeing in employment law, where (former) employees use DSARs to prepare a claim for an unreasonable, unfair or discriminatory dismissal? While the pragmatic ruling of the ECJ is certainly to be applauded, the specific circumstances of the case that led to the judgment, and the criteria put forward by the ECJ for assessing an “excessive request”, require us to be cautious.

In the case at hand, the data subject had subscribed to a newsletter of an optician, by entering his personal data in the registration form on the company’s website and consenting to the processing of that data. Thirteen days later, they sent a DSAR. When the company refused to respond, the data subject maintained their request and added a claim for compensation. According to publicly available information, the data subject had used the same modus operandi with various data controllers. The abusive nature of the request was in other words fairly apparent.

When an employee is dismissed and subsequently files a DSAR, the abuse is far less blatant, but in most cases it will still be clear that the purpose of the DSAR is not for the employee to assess their rights to rectification, erasure, etc.  Unfortunately for employers, however, the criteria put forward by the ECJ for assessing whether a DSAR is excessive (the fact that the data subject provided personal data without being obliged to do so, the aim of providing that data, the time that elapsed between the provision of that data and the request for access, and the conduct of the data subject) are less relevant in an employment context and would therefore seem to make it harder to demonstrate abuse when an employee files a DSAR.

It will be interesting to see whether and how national Data Protection Authorities adopt the ECJ’s judgment in their future decisions.

Keep an eye out for our next blog when we will take a look at the different EU member states and the role that DSARs have come to play in employment matters in these jurisdictions.