Judgment;Abstract — ECLI:EU:C:2026:216
Date: 2026-03-19
Language of the case: German
Court formation: Fourth Chamber
Procedure: Reference for a preliminary ruling
Origin: Germany

Anonymised version 
Translation C-526/24 – 1 
Case C-526/24 
Request for a preliminary ruling 
Date lodged: 
31 July 2024 
Court: 
Amtsgericht Arnsberg (Germany) 
Date of the decision to refer: 
31 July 2024 
Applicant and defendant to the counterclaim: 
Brillen Rottler GmbH & Co. KG 
Defendant and counterclaimant: 
TC 
  
42 C 434/23 
Amtsgericht Arnsberg 
Order 
In the dispute between 
Brillen Rottler GmbH & Co. KG, […] 
Applicant and defendant to the counterclaim, 
[…] 
and 
Mr TC, […] 
EN 
REQUEST FOR A PRELIMINARY RULING OF 31. 7. 2024 – CASE C-526/24 
 
2  
Anonymised version 
Defendant and counterclaimant, 
[…], 
the Amtsgericht Arnsberg (Local Court, Arnsberg) 
has ordered as follows 
[…] 
on 31 July 2024: 
I. 
The following questions are referred to the Court of Justice of the European 
Union (Court of Justice) for a preliminary ruling pursuant to Article 267 of 
the Treaty on the Functioning of the European Union (TFEU): 
1. Is the second sentence of Article 12(5) of the General Data Protection 
Regulation (GDPR) to be interpreted as meaning there cannot be an 
excessive information request from the data subject when the first request is 
made to the controller? 
2. Is the second sentence of Article 12(5) of the GDPR to be interpreted as 
meaning that the controller can refuse an information request from the data 
subject if the data subject intends to use the information request to provoke 
claims for damages against the controller? 
3. Is the second sentence of Article 12(5) of the GDPR to be interpreted as 
meaning that grounds for refusing to provide information can be provided by 
publicly available information about the data subject which suggests that the 
data subject is asserting claims for damages against the controller in a large 
number of cases of infringement of the law relating to the protection of 
personal data? 
4. Is Article 4(2) of the GDPR to be interpreted as meaning that an 
information request from a data subject to the controller pursuant to 
Article 15(1) of the GDPR and/or a response to that request constitutes 
processing within the meaning of Article 4(2) of the GDPR? 
5. In view of the first sentence of recital 146 of the GDPR, is Article 82(1) 
thereof to be interpreted as meaning that only damage which the data subject 
suffers or has suffered as a result of processing is eligible for compensation? 
Does this mean that for there to be a claim for damages under Article 82(1) of 
the GDPR – assuming causal damage to the data subject exists – there must 
necessarily have been processing of the data subject’s personal data? 
6. If the answer to Question 5 is in the affirmative: Does this mean that the 
data subject – assuming causal damage exists – has no claim for 
BRILLEN ROTTLER 
 
3 
Anonymised version 
compensation under Article 82(1) of the GDPR solely on the basis of an 
infringement of his or her right to information under Article 15(1) of the 
GDPR? 
7. Is Article 82(1) of the GDPR to be interpreted as meaning that the 
controller’s objection relating to an abuse of right in relation to an 
information request from the data subject cannot, in view of EU law, consist 
in the fact that the data subject brought about processing of his or her 
personal data solely or inter alia in order to assert claims for damages? 
8. If the answers to Questions 5 and 6 are in the negative: Does the mere 
loss of control and/or uncertainty about the processing of the data subject’s 
personal data associated with an infringement of Article 15(1) of the GDPR 
constitute non-material damage to the data subject within the meaning of 
Article 82(1) of the GDPR or does it also require a further (objective or 
subjective) restriction and/or (significant) damage to the data subject? 
II. 
The parties disagree on claims under the law on the protection of personal data 
and whether those claims constitute an abuse of right. 
The applicant, a family run optician company established in Arnsberg, North 
Rhine-Westphalia, is seeking a declaration that the defendant, a private individual 
living in Vienna, is not entitled to compensation in the amount of EUR 1 000. 
On 16 March 2023, the defendant subscribed to the ‘newsletter’ on the applicant’s 
website by entering his personal data in the registration form, confirming his 
consent to data processing by ticking a box and submitting the form. On 29 March 
2023, the defendant sent by fax an information request pursuant to Article 15 of 
the GDPR. 
The applicant acknowledged receipt of the request and stated that it would 
respond to it within the one-month period. However, by letter of 26 April 2023, 
the applicant refused to provide the information since it classified the information 
request as an abuse of right for the purposes of the second sentence of 
Article 12(5)(b) of the GDPR. The defendant was requested finally to abandon his 
claim by 3 May 2023, otherwise the matter would be referred to a lawyer. 
The defendant did not comply with that request and pursued his claim for 
information and a claim for damages under Article 82 of the GDPR. By letter of 
29 June 2023, he requested compensation of EUR 1 000. 
The parties disagree as to whether the defendant is asserting claims under the law 
on the protection of personal data in an abusive manner. 
The applicant claims that the defendant systematically and abusively uses 
information requests under the law on the protection of personal data in order 
REQUEST FOR A PRELIMINARY RULING OF 31. 7. 2024 – CASE C-526/24 
 
4  
Anonymised version 
subsequently to assert claims for damages. This is apparent from a number of 
reports in relevant online media, which document the defendant’s conduct in 
many cases. The applicant bases its view on various blog posts and reports by 
lawyers who describe similar cases and termed the defendant’s conduct ‘business-
like’. It further argues that the defendant’s conduct undermines the protective 
purpose of the GDPR since he is not concerned with the protection of his personal 
data, but solely with extorting financial compensation. In that regard, the applicant 
refers to the order of the Oberlandesgericht Hamm (Higher Regional Court, 
Hamm), according to which abusive requests do not establish that a claim for 
information exists (Oberlandesgericht, Hamm, order of 15 November 2021 – 20 U 
269/21). 
According to the applicant, the defendant is not actually affected since he 
deliberately provokes infringements of the law relating to the protection of 
personal data. The applicant bases its claim on reports from lawyers which 
document the defendant following the same pattern in a large number of cases: 
subscription to a newsletter, information request and a subsequent claim for 
damages. The applicant has submitted various blog posts and online reports as 
evidence. 
The defendant takes the view that his information request is not an abuse of right. 
He claims that the request is legitimate and is consistent with his right to 
information under Article 15 of GDPR. The defendant points out that the right to 
information is not linked to the applicant’s motives and that any data subject can 
assert that right unconditionally. He bases that view on the case-law of the Court 
of Justice, which has emphasised the scope and unconditionality of the right to 
information (Court of Justice of the European Union, judgment of 9 September 
2021, C-33/20, C-155/20 and C-187/20). The defendant further argues that the 
applicant is seeking to restrict his rights under the GDPR unlawfully and that he 
therefore has a claim for damages under Article 82 thereof. In addition, the 
defendant points out that he is regularly in Germany – in particular in Düsseldorf 
and Munich – and therefore has a legitimate interest in the applicant’s newsletter. 
The defendant denies the claims relating to the abusive use of claims under the 
law on the protection of personal data and invokes the fundamental right to 
information under Article 15 of the GDPR, regardless of the applicant’s motives. 
The Court of Justice has emphasised in several decisions that the right to 
information can be exercised comprehensively and without conditions (Court of 
Justice, judgment of 9 September 2021, C-33/20, C-155/20 and C-187/20). The 
defendant also points out that the applicant did not provide him with the 
transparency required under Article 12 of the GDPR in that it failed to explain 
sufficiently the reasons for the refusal of his information request. 
On 25 September 2023, the defendant lodged a counterclaim. 
The applicant claims that 
BRILLEN ROTTLER 
 
5 
Anonymised version 
1. the defendant should be declared to have no claim against the applicant for 
payment of compensation in the amount of EUR 1 000, 
2. the defendant should be ordered to pay the costs of the proceedings and 
3. the judgment should be declared provisionally enforceable – if necessary on 
provision of security. 
The defendant contends that 
1. the action should be dismissed and 
2. in response to the counterclaim, the applicant should be ordered to, 
a. provide the defendant with a copy of all personal data which the 
applicant processes about the defendant, 
b. provide the defendant with information about the processing purposes 
for which the applicant processes the defendant’s personal data, 
c. provide the defendant with information about the recipients of his data 
to whom the applicant has transmitted the defendant’s personal data, 
d. provide the defendant with information as to whether the applicant has 
carried out automated decision-making or profiling with regard to the 
defendant’s personal data, 
e. pay the defendant pecuniary compensation for non-material damages, 
the amount of which is at the discretion of the court, but should not be less 
than EUR 1 000.00, and 
f. pay pre-trial costs in the amount of EUR 719.95, plus default interest 
in the amount of five percentage points above the applicable base rate on 
EUR 1 719.95 5 from the commencement of proceedings. 
At the hearing held on 15 October 2023, the parties once again discussed the facts 
of the case in detail. The applicant reiterated that the defendant’s requests were 
systematic and abusive and in that regard relied on further media reports. The 
defendant rejected those claims and argued that his information request was 
legitimate and lawful. 
The court decided to refer the questions set out in point I. to the Court of Justice of 
the European Union (‘Court of Justice’) for a preliminary ruling pursuant to 
Article 267 of the Treaty on the functioning of the European Union (TFEU): 
Proceedings have been stayed pending the decision of the Court of Justice. 
III. 
REQUEST FOR A PRELIMINARY RULING OF 31. 7. 2024 – CASE C-526/24 
 
6  
Anonymised version 
The outcome of the dispute turns on the interpretation of EU law. 
1. 
Provisions of national law, in particular Paragraph 34 of the 
Bundesdatenschutzgesetz (Federal law on data protection; ‘BDSG’), 
Paragraph 242 of the Bürgerliches Gesetzbuch (Civil Code; ‘BGB’) and 
Paragraph 226 of the Zivilprozessordnung (Code of Civil Procedure; ‘ZPO’) are 
not relevant in the present case. 
Paragraph 34 of the BDSG sets out the obligations to provide information in 
German law relating to the protection of personal data and could be used as a 
supplement to specify the requirements concerning information. However, as a 
European regulation, the GDPR is subject to the primacy of EU law and therefore 
provisions of national law such as Paragraph 34 of the BDSG are not decisive, but 
can only be used as an aid to understanding the GDPR. 
The court also does not consider Paragraph 242 of the BGB (good faith) to be 
relevant since the GDPR takes precedence in this context. Paragraph 242 of the 
BGB concerns the principle of good faith and is applied in German law to prevent 
conduct constituting an abuse of rights. Since this case concerns the interpretation 
of EU law and more specifically the GDPR, rules of national law such as 
Paragraph 242 of the BGB are not directly applicable. 
The same applies to Paragraph 226 of the ZPO, which lays down the prohibition 
on acting contrary to good faith in the procedural area. That paragraph aims to 
prevent abusive conduct in civil proceedings, but is not directly applicable to the 
interpretation of the GDPR. 
2. 
The court has doubts regarding the interpretation of EU law. 
The outcome of the national dispute depends on the interpretation of Articles 4(2), 
15(1), and 82(2) of the GDPR in particular. 
The court has doubts as to the interpretation of EU law, in particular with regard 
to the following points: 
It is unclear whether there can be an excessive information request from the data 
subject when the first request is made to the controller. The wording of the second 
sentence of Article 12(5) of the GDPR is not clear in that regard and there is no 
clear guidance from the previous case-law of the Court of Justice. 
Furthermore, in connection with the second sentence of Article 12(5) of the 
GDPR, the question arises as to whether the controller can refuse an information 
request from the data subject if the data subject intends to use the information 
BRILLEN ROTTLER 
 
7 
Anonymised version 
request to provoke claims for damages against the controller. The GDPR contains 
no explicit provisions on how to deal with requests that may be made in bad faith. 
There are also doubts about the interpretation with regard to publicly available 
information about the data subject which suggests that the data subject is asserting 
claims for damages against the controller in a large number of cases of 
infringement of the law relating to the protection of personal data, which can 
provide grounds for refusing to provide information. This concerns the question of 
the extent to which publicly available information about the conduct of the data 
subject may be used as a basis for assuming an abuse of right. 
It also depends on the interpretation of the GDPR whether a data subject’s 
information request from the controller pursuant to Article 15(1) of the GDPR 
and/or the response to such a request constitutes processing within the meaning of 
Article 4(2) of the GDPR. This concerns the definition of processing and its 
application to requests and responses. 
Another essential question concerns eligibility for compensation under 
Article 82(1) of the GDPR: It must be clarified whether only damage which the 
data subject suffers or has suffered as a result of processing is eligible for 
compensation. The first sentence of recital 146 of GDPR could have a restrictive 
effect in this case, but there is no clear interpretation by the Court of Justice. 
Finally, the question arises as to whether the data subject has a claim for 
compensation under Article 82(1) of the GDPR solely on the basis of an 
infringement of his right to information under Article 15(1) of the GDPR. There 
are no precise provisions on this in the GDPR and no corresponding case-law of 
the Court of Justice. 
The questions submitted are also related to provisions of national law which are 
not directly applicable here, but can be used to determine the context of EU law. 
In German law, the concept of abuse of right is used in various contexts, for 
example in the area of civil law (Paragraph 242 of the BGB – good faith). That 
provision could be applied mutatis mutandis to shed light on the concept of abuse 
of right in the context of EU law. Provisions of national law which govern the 
abuse of procedural rights, such as Paragraph 226 of the ZPO (prohibition on 
acting contrary to good faith), can provide guidance. Those rules offer bases for 
determining when exercise of rights is to be classified as abusive. The BDSG 
contains rules on transparency and obligations to provide information which could 
be used as a supplement to the GDPR to specify the requirements concerning 
information. Those provisions of national law provide points of reference and 
interpretative aids to better understand the unanswered questions regarding the 
interpretation of EU law and to ensure consistent application. However, definitive 
clarification is only possible through a preliminary ruling by the Court of Justice, 
which is why these questions have been referred for a ruling. 
IV. 
REQUEST FOR A PRELIMINARY RULING OF 31. 7. 2024 – CASE C-526/24 
 
8  
Anonymised version 
The assessment of the merits of the action depends on the answer to the questions 
referred, which have not already been clarified or answered beyond doubt by the 
case-law of the Court of Justice. 
1. Question 1 
In view of recitals 63 and 64 of the GDPR, the court does not completely rule out 
the possibility that an excessive request may be possible in an individual case, 
even in the case of an initial information request, but having regard to 
Article 5(1)a) of the GDPR it is conceivable only in very exceptional cases. If the 
requirement relating to an excessive request were interpreted too liberally, that 
would lead to a curtailment of the data subject’s rights and a lack of transparency. 
As long as his or her personal data are purportedly processed by a controller, the 
data subject must have the right to information in accordance with Article 15 of 
the GDPR. 
2. Question 2 
The court considers that a refusal of the information request by the controller 
solely on account of the data subject’s intention to prepare claims for damages is 
not permissible. Any other interpretation would be tantamount to forfeiting the 
right to information. A data subject who may have requested information about 
the processing in an abusive manner in the past must nevertheless retain that 
possibility in light of the interests to be protected under the GDPR. Furthermore, it 
is a legislative decision, which must be respected, to ensure the lawfulness of the 
processing of personal data by the respective controllers in such a way that the 
controllers must be accountable to all data subjects for processing solely within 
the limits of abuse. 
3. Question 3 
In the light of the foregoing and the resulting risk of abuse by the relevant 
controller and also the associated curtailment of the rights of the data subject, the 
referring court does not consider that the reference to public information, which 
shows that the data subject is making a large number of information requests, is 
sufficient in itself to provide grounds for an abuse of right or the non-provision of 
information. 
4. Question 4 
The court provisionally assumes that, although Article 4(2) of the GDPR can be 
interpreted as meaning that the receipt of, processing of and response to each 
information request pursuant to Article 15 of the GDPR involves the processing of 
personal data, the information request does not in itself constitute processing. The 
court finds that Article 6(1)(c) of the GDPR, in conjunction with Article 15 
thereof, provides grounds for the processing required by the information request. 
5. Question 5 
BRILLEN ROTTLER 
 
9 
Anonymised version 
The court assumes that any infringement of the GDPR is capable of providing 
grounds for a claim for damages, assuming that the data subject has suffered 
causal damage as a result of the infringement. In the view of the court, the 
processing of personal data is not required for a claim under Article 82(1) of the 
GDPR. The court infers this, inter alia, from the wording of Article 15(1) of the 
GDPR, which also includes the negative information that no data are being 
processed. 
6. Question 6 
Accordingly, the court considers it possible that the data subject may have a claim 
for damages under Article 82(1) of the GDPR as a result of the infringement of his 
right to information. 
7. Question 7 
The court considers that it is a legislative decision, which is to be respected, that 
information requests can be aimed at uncovering infringements of the GDPR. The 
court therefore considers that the assertion of claims for damages by the data 
subject in the event of an infringement of the GDPR by the controller is legitimate 
in principle. 
8. Question 8 
In cases where the data subject (as established by a court) is concerned with the 
‘loss of control’, the court assumes that non-material damage cannot be derived 
solely from the loss of control, but that an additional impairment of the data 
subject must be demonstrated, which does not have to exceed a de minimis 
threshold. However, the enforcement of the right to information by the data 
subject, for example, consulting a legal adviser, can provide grounds for material 
damage. 
[…]