Judgment;Abstract — ECLI:EU:C:2025:3
Date: 2025-01-09
Language of the case: German
Court formation: First Chamber
Subject matter: Data protection
Procedure: Reference for a preliminary ruling
Origin: Austria

Summary C-416/23 – 1 
Case C-416/23 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
6 July 2023 
Referring court: 
Verwaltungsgerichtshof (Supreme Administrative Court, Austria) 
Date of the decision to refer: 
27 June 2023 
Appellant on a point of law: 
Österreichische Datenschutzbehörde (Austrian Data Protection 
Authority) 
Anonymous interested party 
  
Subject matter of the main proceedings 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation – GDPR) – Interpretation of the 
concept of excessive requests for the purposes of Article 57(4) of the GDPR – 
Charging a reasonable fee for processing – Refusal to process 
Subject matter and legal basis of the request for a preliminary ruling 
Request for interpretation of a legal provision under Article 267 TFEU 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-416/23 
 
2  
Questions referred 
1. Must the concept of ‘requests’ or ‘request’ in Article 57(4) of Regulation 
(EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on 
the protection of natural persons with regard to the processing of personal data 
and on the free movement of such data, and repealing Directive 95/46/EC 
(General Data Protection Regulation – GDPR) be interpreted as meaning that it 
also covers ‘complaints’ under Article 77(1) of the GDPR? 
If Question 1 is answered in the affirmative: 
2. Must Article 57(4) of the GDPR be interpreted as meaning that, for 
requests to be ‘excessive’, it is sufficient that a data subject has merely addressed 
a certain number of requests (complaints under Article 77(1) of the GDPR) to a 
supervisory authority within a certain period of time, irrespective of whether the 
facts are different and/or whether the requests (complaints) concern different 
controllers, or is an abusive intention on the part of the data subject required in 
addition to the frequent repetition of requests (complaints)? 
3. Must Article 57(4) of the GDPR be interpreted as meaning that, in the case 
of a ‘manifestly unfounded’ or ‘excessive’ request (complaint), the supervisory 
authority is free to choose whether to charge a reasonable fee based on the 
administrative costs of processing it or refuse to process it from the outset? If not, 
which circumstances and criteria must the supervisory authority take into account? 
In particular, is the supervisory authority obliged to charge a reasonable fee 
primarily, as a less severe measure, and entitled to refuse to process manifestly 
unfounded or excessive requests (complaints) only in the event that charging a fee 
to prevent such requests is futile? 
Provisions of EU law relied on 
Article 57(4) and Article 77(1) of the GDPR 
Provisions of national law relied on 
Paragraph 24 of the Datenschutzgesetz – DSG (Law on Data Protection), BGBl. I 
No 165/1999 in the version in BGBl. I No 120/2017, is worded, in part, as 
follows: 
‘Complaints to the Data Protection Authority 
ÖSTERREICHISCHE DATENSCHUTZBEHÖRDE 
 
3 
Paragraph 24 (1) Every data subject has the right to lodge a complaint with the 
Data Protection Authority if the data subject is of the opinion that the processing 
of the personal data concerning the data subject infringes the GDPR …’ 
… 
(5) To the extent the complaint is shown to be justified, it is to be granted. If an 
infringement can be attributed to a private-sector controller, the controller shall be 
instructed to comply with the complainant’s requests for information, 
rectification, erasure, restriction or data communication to the extent required to 
eliminate the infringement that has been found to exist. To the extent that the 
complaint is not found to be justified, it shall be rejected. 
…’ 
Brief summary of the facts and procedure 
1 On 17 February 2020, the interested party lodged a data protection complaint with 
the Data Protection Authority pursuant to Article 77(1) of the General Data 
Protection Regulation (GDPR) for breach of the right of access under Article 15 
of the GDPR. 
2 In that regard, the interested party submitted that he had sent the request for 
information under Article 15 of the GDPR to B O BV (the party complained 
against), a limited liability company with its registered office in the Netherlands, 
on 7 January 2020. The request was delivered on 13 January 2020. The party 
complained against did not react to the request within one month. 
3 By decision of 22 April 2020, the Data Protection Authority refused to deal with 
the data protection complaint pursuant to Article 57(4) of the GDPR. 
4 The reasoning given by the Data Protection Authority was that, between 
28 August 2018 and 7 April 2020, the interested party had submitted to it a total 
of 77 data protection complaints, namely 4 data protection complaints in 2018, 53 
in 2019 and a further 20 in the first quarter of 2020. He asserted the right to 
erasure in 46 cases and the right of access in 29 cases. The facts underlying the 
data protection complaints are essentially the same. The interested party initially 
submits requests for access or erasure to different data controllers. He then lodges 
a complaint with the Data Protection Authority often a few days after the expiry of 
the ‘one-month period’ within which the controller has not responded. In addition, 
he regularly contacts the Data Protection Authority by telephone. 
5 The interested party brought an action against that decision before the 
Bundesverwaltungsgericht (Federal Administrative Court) (‘the administrative 
court’). 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-416/23 
 
4  
6 By judgment of 22 December 2022, the administrative court upheld the complaint 
and annulled the decision of the Data Protection Authority of 22 April 2020 
without replacing it. The reasoning given by the administrative court was, in 
essence, that it could not be derived with sufficient certainty from the wording of 
Article 57(4) of the GDPR or the recitals or from a systematic reading of the 
GDPR when ‘a request’ was to be judged as ‘excessive’. In summary, in 
accordance with Article 57(4) of the GDPR, for requests to be ‘excessive’, there 
must not only be a frequent repetition of requests, but they must also be 
‘manifestly vexatious or abusive in nature’, which the Data Protection Authority 
had not demonstrated in the present case. If the number of requests was taken into 
account in isolation, that could lead to an arbitrary obstruction of the legal 
protection of the data subject. 
7 The Data Protection Authority challenged that judgment before the 
Verwaltungsgerichtshof (Supreme Administrative Court). 
Main arguments of the parties to the main proceedings 
8 According to the Data Protection Authority, by constantly submitting new 
complaints, the interested party has tied up ‘the Data Protection Authority’s 
limited staff resources for one and a half years’, those actions being ‘to his 
advantage and to a disproportionate extent’ compared to other complainants who 
submit fewer complaints. In addition, it is to be assumed that the interested party 
will continue to make heavy use of the activities of the Data Protection Authority 
in the future. 
9 The interested party admittedly has an interest in the provision of information 
under Article 15 of the GDPR which does not require further justification. 
However, in order for a data protection complaint to be made under Article 77 of 
the GDPR in conjunction with Paragraph 24(1) of the Law on Data Protection 
(DSG), there must be a certain need for protection, the threshold for which must 
be set at a low level. Otherwise, the EU legislature would not have granted the 
supervisory authorities the possibility, under Article 57(4) of the GDPR, to 
derogate from the principle that a complaint is free of charge or to refuse to deal 
with the complaint in certain cases. 
10 In his response, the interested party requested that the appeal on a point of law be 
dismissed as inadmissible or, in the alternative, dismissed as unfounded. 
Brief summary of the reasons for the request for a preliminary ruling 
11 The Supreme Administrative Court is a court within the meaning of Article 267 
TFEU against whose decisions there is no judicial remedy under national law. 
12 Question 1: The Data Protection Authority and the administrative court consider 
that complaints by data subjects under Article 77(1) of the GDPR also fall under 
ÖSTERREICHISCHE DATENSCHUTZBEHÖRDE 
 
5 
the concept of ‘requests’ or ‘request’ within the meaning of Article 57(4) of the 
GDPR. The interpretation of a ‘request’ in Article 57(4) of the GDPR is essential 
in the present case since, if complaints under Article 77(1) are not covered by it, 
any supervisory authority would in principle be precluded from refusing to handle 
complaints under Article 57(4) of the GDPR or from charging a reasonable fee for 
handling them, irrespective of whether they may be manifestly unfounded or 
excessive. 
13 The concept of ‘requests’ within the meaning of Article 57(4) of the GDPR is not 
defined more precisely in the GDPR. The context of paragraph 3 suggests that that 
concept also includes complaints under Article 77(1) of the GDPR, the handling 
of the latter being a primary task of any supervisory authority. The associated 
demand on the supervisory authorities is further increased by the obligation under 
Article 57(2) of the GDPR to facilitate the submission of complaints by a 
complaint submission form which can also be completed electronically and the 
principle of providing services free of charge, in accordance with Article 57(3) of 
the GDPR. In that context, it is obvious that Article 57(4) of the GDPR, as a 
provision derogating from the principle of providing services free of charge, also 
covers the handling of complaints under Article 77(1) of the GDPR, in order to 
relieve the supervisory authorities from handling manifestly unfounded or 
excessive complaints. 
14 Such an interpretation does limit the supervisory authority’s obligation to handle 
complaints under Article 77(1) of the GDPR and is, in principle, contrary to the 
objectives of that regulation set out in recitals 10 and 11 of the GDPR. However, 
both the charging of a reasonable fee and the refusal to act are necessarily subject 
to judicial review in accordance with Article 78(1) of the GDPR. 
15 The interpretation of the concept of ‘requests’ in Article 57(4) of the GDPR and 
the application of that provision are not so obvious as to leave no scope for any 
reasonable doubt as to the manner in which the question raised is to be resolved. 
16 Question 2: The term ‘excessive’ is not defined in the GDPR, nor is the notion 
‘manifestly unfounded’. The second sentence of Article 12(5) of the GDPR 
contains, as an exception to the principle that information provided under 
Articles 13 and 14 of the GDPR and any communication and any actions taken 
under Articles 15 to 22 and 34 of the GDPR are to be provided free of charge, a 
rule for the controller which is parallel to Article 57(4) of the GDPR. Both 
Article 12(5) of the GDPR and Article 57(4) of the GDPR mention, by way of 
example of ‘excessive’ requests, the repetitive character of such requests. 
However, the introduction of an extremely large number of complaints compared 
with other complainants does not, in itself, constitute an ‘excessive’ or abusive 
(disproportionate) assertion of rights if the complaints concern different 
respondents without any other circumstances indicating an abusive intention on 
the part of the complainant. An above-average expenditure of time and effort 
caused by a single complainant is excessive only if it is due to a profusion of 
insubstantial or rambling statements, while taking into account that complainants 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-416/23 
 
6  
generally lack legal or technical knowledge. In order to cope with an increased 
workload, Member States are required to provide their supervisory authorities 
with sufficient human and material resources to carry out their duties. 
17 An abuse of the right conferred by Article 77(1) of the GDPR on every data 
subject would have to be assumed inter alia if the data subject does not (primarily) 
seek the protection of his or her personal data, but rather pursues objectives which 
are disapproved of by the legal system, such as lodging a complaint with the 
purpose of harming the controller and/or placing an undue burden on the 
supervisory authority (see judgment of the Court of Justice of 23 March 2000, 
Diamantis, C-373/97, paragraph 33 et seq.). 
18 However, the question of the content of the concept of ‘excessive’ in Article 57(4) 
of the GDPR cannot be answered beyond doubt on the basis of its wording or 
context. 
19 Question 3: According to the wording of Article 57(4) of the GDPR, where 
requests are manifestly unfounded or excessive, the two alternatives for action by 
the supervisory authority, namely either ‘[to] charge a reasonable fee based on 
administrative costs’ or ‘[to] refuse to act on the request’, appear side by side, 
without it being possible to conclude that there is a priority relationship between 
them. It is therefore not clear from the wording of Article 57(4) of the GDPR 
whether the supervisory authorities are free to choose between those two options. 
In the legal literature, different opinions are expressed in that regard: according to 
one view, the authority has the freedom to choose. According to another view, a 
reasonable fee should be charged first, and it is only if the levying of a fee does 
not prevent the submission of manifestly unfounded or excessive requests that the 
supervisory authorities would be entitled, as a further step, to refuse to process 
them. 
20 Accordingly, there are also doubts concerning the application of Article 57(4) of 
the GDPR with regard to the two alternative courses of action provided for in that 
provision in the event of manifestly unfounded or excessive requests. Since the 
application and interpretation of EU law is not so obvious as to leave no scope for 
any reasonable doubt (see judgment of the Court of Justice of 6 October 1982, 
Cilfit and Others, 283/81, EU:C:1982:335), the questions set out at the start of this 
order are submitted by way of a request for a preliminary ruling. 
Vienna, 27 June 2023