Case C-416/23, Österreichische Datenschutzbehörde (Excessive requests: Judgment of the Court (First Chamber) of 9 January 2025 (request for a preliminary ruling from the Verwaltungsgerichtshof – Austria) – Österreichische Datenschutzbehörde v F R (Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 57(1)(f) and Article 57(4) – Tasks of the supervisory authority – Concepts of a request and excessive requests – Charging of a reasonable fee or refusal to act on requests in the event of manifestly unfounded or excessive requests – Criteria which may guide the supervisory authority in making its choice – Article 77(1) – Concept of a complaint)
Date: 2025-01-09
Institutions: Court of Justice
Subjects: administrative formalities, data protection, data-processing law, payment, personal data, protection of privacy, supervisory body








C_202501202EN.000101.fmx.xml












Official Journal of the European Union


EN
C series













C/2025/1202


3.3.2025






Judgment of the Court (First Chamber) of 9 January 2025 (request for a preliminary ruling from the Verwaltungsgerichtshof – Austria) – Österreichische Datenschutzbehörde v F R


(Case C-416/23,
                (1)
Österreichische Datenschutzbehörde (Excessive requests)

(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Regulation (EU) 2016/679 - Article 57(1)(f) and Article 57(4) - Tasks of the supervisory authority - Concepts of a ‘request’ and ‘excessive requests’ - Charging of a reasonable fee or refusal to act on requests in the event of manifestly unfounded or excessive requests - Criteria which may guide the supervisory authority in making its choice - Article 77(1) - Concept of a ‘complaint’)
(C/2025/1202)
Language of the case: German

Referring court

Verwaltungsgerichtshof

Parties to the main proceedings


Appellant: Österreichische Datenschutzbehörde

Respondent: F R

Other party: Bundesministerin für Justiz

Operative part of the judgment







1.


Article 57(4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
must be interpreted as meaning that the concept of a ‘request’ contained in that provision covers the complaints referred to in Article 57(1)(f) and Article 77(1) of that regulation.










2.


Article 57(4) of Regulation 2016/679
must be interpreted as meaning that requests cannot be classified as ‘excessive’, within the meaning of that provision, solely on account of their number during a specific period, since the exercise of the option provided for in that provision is subject to the supervisory authority’s demonstrating the existence of an abusive intention on the part of the person who submitted those requests.










3.


Article 57(4) of Regulation 2016/679
must be interpreted as meaning that, when faced with excessive requests, a supervisory authority may choose, by reasoned decision, between charging a reasonable fee based on administrative costs and refusing to act on those requests, taking account of all the relevant circumstances and satisfying itself that the chosen option is appropriate, necessary and proportionate.






(1)  OJ C C/2023/12.


ELI: http://data.europa.eu/eli/C/2025/1202/oj
ISSN 1977-091X (electronic edition)