DATA PROTECTION
EU Court of Justice: interpretative clarifications on the notion of "excessive requests" pursu-ant to Article 57, paragraph 4, of the GDPR.
Article 57, paragraph 4, of Regulation 679/2016 ("GDPR") provides that the supervisory authority may charge a reasonable fee based on administrative costs or refuse to comply with the requests of the subjects who turn to it (including when lodging a complaint or requests for access) if the requests are manifestly unfounded or excessive, in particular for the repetitive nature, it is for the supervisory authority to demonstrate the manifestly unfounded or excessive nature of the request.
Max Schrems, a well-known Austrian business, had submitted 77 complaints to the Austrian privacy authority (DSB) - in a period of about 20 months - regarding the refusal of a well-known social network to verify his requests for access. Complaints rejected by the Austrian privacy authority as they were considered excessive for their number.
The Court of Justice of the European Union (CJEU) ruled on Case C-416/23, stating that "excessive" access requests under the GDPR cannot be considered as such only because of their number. The CJEU first clarified that, pursuant to Article 57(4) of the GDPR, the term "request" also includes complaints pursuant to Art. 77 of the GDPR. In addition, requests cannot be classified as 'excessive' within the meaning of Article 57(4) of the GDPR solely because of their number over a given period, since the exercise of the option provided for in that provision is subject to the demonstration by the supervisory authority of the existence of abusive intent on the part of the person who made those requests. Finally, when faced with excessive requests, a supervisory authority may choose, by reasoned decision, between charging a reasonable fee based on administrative costs or refusing to comply with the request, taking into account all relevant circumstances and ensuring that the preferred option is appropriate, necessary and proportionate.
Max Schrems, a well-known Austrian business, had submitted 77 complaints to the Austrian privacy authority (DSB) - in a period of about 20 months - regarding the refusal of a well-known social network to verify his requests for access. Complaints rejected by the Austrian privacy authority as they were considered excessive for their number.
The Court of Justice of the European Union (CJEU) ruled on Case C-416/23, stating that "excessive" access requests under the GDPR cannot be considered as such only because of their number. The CJEU first clarified that, pursuant to Article 57(4) of the GDPR, the term "request" also includes complaints pursuant to Art. 77 of the GDPR. In addition, requests cannot be classified as 'excessive' within the meaning of Article 57(4) of the GDPR solely because of their number over a given period, since the exercise of the option provided for in that provision is subject to the demonstration by the supervisory authority of the existence of abusive intent on the part of the person who made those requests. Finally, when faced with excessive requests, a supervisory authority may choose, by reasoned decision, between charging a reasonable fee based on administrative costs or refusing to comply with the request, taking into account all relevant circumstances and ensuring that the preferred option is appropriate, necessary and proportionate.
