Case law

Brillen Rottler

C-526/24

Gericht: Court of Justice of the European Union
Aktenzeichen: C-526/24
Datum: 31.07.2024
Dokumenttyp: Order for reference

Automatically analysed

Decision overview

Unofficial

The Amtsgericht Arnsberg referred eight questions to the Court of Justice of the European Union regarding the interpretation of GDPR provisions on data subject rights, abuse of rights, processing definitions, and compensation for damages.

A German local court (Amtsgericht Arnsberg) referred eight preliminary ruling questions to the Court of Justice of the European Union concerning the interpretation of GDPR provisions. The questions address issues such as excessive information requests, abuse of rights in data subject requests, whether information requests constitute processing, and eligibility for compensation under Article 82 GDPR.

Outcome: The referring court ordered that eight questions be referred to the Court of Justice of the European Union for a preliminary ruling pursuant to Article 267 TFEU.

Facts

The defendant subscribed to the applicant's newsletter on 16 March 2023 by entering personal data in a registration form, confirming consent to data processing.

Establishes the data processing relationship and the defendant's status as a data subject.
The defendant sent an information request pursuant to Article 15 GDPR by fax on 29 March 2023.

Initiates the dispute regarding the data subject's right to information.
The applicant acknowledged receipt of the information request and stated it would respond within one month.

Shows the applicant's initial procedural compliance with the GDPR.
The applicant refused to provide the requested information on 26 April 2023, classifying the request as an abuse of right under Article 12(5)(b) GDPR.

The core dispute: whether the data subject's request constitutes an abuse of right.
The applicant requested the defendant to abandon his claim by 3 May 2023, threatening to refer the matter to a lawyer.

Demonstrates the applicant's position that the defendant's claim is abusive.
The defendant did not comply with the request to abandon his claim and pursued both the information request and a claim for damages under Article 82 GDPR.

Shows the escalation of the dispute and the defendant's assertion of rights.
The defendant requested compensation of EUR 1,000 by letter of 29 June 2023.

Quantifies the damages claim central to the dispute.
The applicant claims the defendant systematically and abusively uses information requests to assert claims for damages, supported by media reports and legal blogs.

Provides the applicant's justification for alleging abuse of right.
The defendant argues that his information request is legitimate and consistent with his right to information under Article 15 GDPR, which cannot be conditioned on the applicant's motives.

Represents the defendant's position on the legitimacy of the request.
The defendant counterclaimed for provision of all personal data, information about processing purposes, recipients, automated decision-making, and payment of at least EUR 1,000 in non-material damages plus costs.

Outlines the defendant's full claim in the proceedings.

Legal issues

Is the second sentence of Article 12(5) of the GDPR to be interpreted as meaning there cannot be an excessive information request from the data subject when the first request is made to the controller?

An excessive request may be possible in an individual case even for an initial request, but only in very exceptional circumstances having regard to Article 5(1)(a) GDPR.

The court acknowledges the theoretical possibility of an excessive request but emphasizes that interpreting this too liberally would curtail data subject rights and undermine transparency. As long as personal data are purportedly processed, the right to information under Article 15 must be preserved.

decisive excessive information request abuse of right right to information transparency

Legal bases: Article 12(5) GDPR, Article 5(1)(a) GDPR
Is the second sentence of Article 12(5) of the GDPR to be interpreted as meaning that the controller can refuse an information request from the data subject if the data subject intends to use the information request to provoke claims for damages against the controller?

A refusal based solely on the data subject's intention to prepare claims for damages is not permissible.

The court finds that any other interpretation would effectively forfeit the right to information. The GDPR requires controllers to be accountable to all data subjects within the limits of abuse, and the data subject's motives do not negate the right to information.

decisive abuse of right intention to provoke claims right to information controller accountability

Legal bases: Article 12(5) GDPR
Is the second sentence of Article 12(5) of the GDPR to be interpreted as meaning that grounds for refusing to provide information can be provided by publicly available information about the data subject which suggests that the data subject is asserting claims for damages against the controller in a large number of cases of infringement of the law relating to the protection of personal data?

Publicly available information showing numerous claims does not in itself constitute sufficient grounds for refusing information.

The court finds that such public information alone cannot establish an abuse of right or justify non-provision of information, as this would risk undermining data subject rights and the protective purpose of the GDPR.

decisive abuse of right publicly available information data subject rights protective purpose of GDPR

Legal bases: Article 12(5) GDPR
Is Article 4(2) of the GDPR to be interpreted as meaning that an information request from a data subject to the controller pursuant to Article 15(1) of the GDPR and/or a response to that request constitutes processing within the meaning of Article 4(2) of the GDPR?

The information request itself does not constitute processing, but the receipt, processing, and response to the request involve processing of personal data.

The court interprets that while the request is not processing, the controller's handling of the request (receipt, processing, response) falls within the definition of processing under Article 4(2) GDPR, which is lawful under Article 6(1)(c) in conjunction with Article 15 GDPR.

decisive processing information request lawful basis for processing controller obligations

Legal bases: Article 4(2) GDPR, Article 15(1) GDPR, Article 6(1)(c) GDPR
In view of the first sentence of recital 146 of the GDPR, is Article 82(1) thereof to be interpreted as meaning that only damage which the data subject suffers or has suffered as a result of processing is eligible for compensation? Does this mean that for there to be a claim for damages under Article 82(1) of the GDPR – assuming causal damage to the data subject exists – there must necessarily have been processing of the data subject’s personal data?

Any infringement of the GDPR can ground a damages claim if causal damage exists; processing of personal data is not a prerequisite for such a claim.

The court interprets Article 82(1) broadly, finding that the right to compensation is not contingent on processing having occurred. The court relies on the wording of Article 15(1) GDPR, which includes negative information about non-processing, supporting the view that damages can arise from infringements of information rights.

decisive compensation for damages causal damage processing requirement infringement of rights

Legal bases: Article 82(1) GDPR, Recital 146 GDPR, Article 15(1) GDPR
If the answer to Question 5 is in the affirmative: Does this mean that the data subject – assuming causal damage exists – has no claim for compensation under Article 82(1) of the GDPR solely on the basis of an infringement of his or her right to information under Article 15(1) of the GDPR?

A data subject may have a claim for damages under Article 82(1) GDPR based solely on an infringement of the right to information under Article 15(1) GDPR.

The court concludes that an infringement of the right to information can constitute a sufficient basis for a damages claim, provided causal damage exists. This follows from the broad interpretation of Article 82(1) established in Question 5.

decisive damages claim infringement of right to information causal damage Article 82(1) GDPR

Legal bases: Article 82(1) GDPR, Article 15(1) GDPR
Is Article 82(1) of the GDPR to be interpreted as meaning that the controller’s objection relating to an abuse of right in relation to an information request from the data subject cannot, in view of EU law, consist in the fact that the data subject brought about processing of his or her personal data solely or inter alia in order to assert claims for damages?

The controller cannot rely on the argument that the data subject initiated processing solely to assert damages claims as a basis for an abuse of right objection.

The court emphasizes that EU law respects the legislative decision to allow information requests aimed at uncovering GDPR infringements. Asserting damages claims following infringements is legitimate and cannot be characterized as an abuse of right based on the data subject's motives for initiating processing.

decisive abuse of right motives for data subject requests legitimacy of damages claims controller objections

Legal bases: Article 82(1) GDPR
If the answers to Questions 5 and 6 are in the negative: Does the mere loss of control and/or uncertainty about the processing of the data subject’s personal data associated with an infringement of Article 15(1) of the GDPR constitute non-material damage to the data subject within the meaning of Article 82(1) of the GDPR or does it also require a further (objective or subjective) restriction and/or (significant) damage to the data subject?

Non-material damage cannot be derived solely from loss of control or uncertainty; an additional impairment must be demonstrated, though this need not exceed a de minimis threshold.

The court distinguishes between mere loss of control/uncertainty and actual non-material damage. While loss of control is relevant, it must be accompanied by an impairment that goes beyond the infringement itself. The enforcement of the right to information (e.g., consulting a lawyer) can ground material damage.

decisive non-material damage loss of control additional impairment de minimis threshold enforcement of rights

Legal bases: Article 82(1) GDPR, Article 15(1) GDPR

The text is an anonymized version of the court's request, with certain details redacted.

The referring court's views expressed in the assessment section are provisional and not binding on the Court of Justice of the European Union.

The Court of Justice has not yet issued a ruling on these referred questions; the analysis reflects only the referring court's interpretation.

The case involves complex questions of EU data protection law where the Court of Justice's definitive interpretation may differ from the referring court's provisional assessment.

The factual background includes allegations by both parties that have not been adjudicated on their merits.

This summary was generated automatically; the cited passages were automatically verified in the original text. This is not a substantive review. Only the official text is authoritative.

Anonymised version Translation C-526/24 – 1 Case C-526/24 Request for a preliminary ruling Date lodged: 31 July 2024 Court: Amtsgericht Arnsberg (Germany) Date of the decision to refer: 31 July 2024 Applicant and defendant to the counterclaim: Brillen Rottler GmbH & Co. KG Defendant and counterclaimant: TC

42 C 434/23 Amtsgericht Arnsberg Order In the dispute between Brillen Rottler GmbH & Co. KG, […] Applicant and defendant to the counterclaim, […] and Mr TC, […] EN

REQUEST FOR A PRELIMINARY RULING OF 31. 7. 2024 – CASE C-526/24

2 Anonymised version Defendant and counterclaimant, […], the Amtsgericht Arnsberg (Local Court, Arnsberg) has ordered as follows […] on 31 July 2024: I. The following questions are referred to the Court of Justice of the European Union (Court of Justice) for a preliminary ruling pursuant to Article 267 of the Treaty on the Functioning of the European Union (TFEU): 1. Is the second sentence of Article 12(5) of the General Data Protection Regulation (GDPR) to be interpreted as meaning there cannot be an excessive information request from the data subject when the first request is made to the controller? 2. Is the second sentence of Article 12(5) of the GDPR to be interpreted as meaning that the controller can refuse an information request from the data subject if the data subject intends to use the information request to provoke claims for damages against the controller? 3. Is the second sentence of Article 12(5) of the GDPR to be interpreted as meaning that grounds for refusing to provide information can be provided by publicly available information about the data subject which suggests that the data subject is asserting claims for damages against the controller in a large number of cases of infringement of the law relating to the protection of personal data? 4. Is Article 4(2) of the GDPR to be interpreted as meaning that an information request from a data subject to the controller pursuant to Article 15(1) of the GDPR and/or a response to that request constitutes processing within the meaning of Article 4(2) of the GDPR? 5. In view of the first sentence of recital 146 of the GDPR, is Article 82(1) thereof to be interpreted as meaning that only damage which the data subject suffers or has suffered as a result of processing is eligible for compensation? Does this mean that for there to be a claim for damages under Article 82(1) of the GDPR – assuming causal damage to the data subject exists – there must necessarily have been processing of the data subject’s personal data? 6. If the answer to Question 5 is in the affirmative: Does this mean that the data subject – assuming causal damage exists – has no claim for

BRILLEN ROTTLER

3 Anonymised version compensation under Article 82(1) of the GDPR solely on the basis of an infringement of his or her right to information under Article 15(1) of the GDPR? 7. Is Article 82(1) of the GDPR to be interpreted as meaning that the controller’s objection relating to an abuse of right in relation to an information request from the data subject cannot, in view of EU law, consist in the fact that the data subject brought about processing of his or her personal data solely or inter alia in order to assert claims for damages? 8. If the answers to Questions 5 and 6 are in the negative: Does the mere loss of control and/or uncertainty about the processing of the data subject’s personal data associated with an infringement of Article 15(1) of the GDPR constitute non-material damage to the data subject within the meaning of Article 82(1) of the GDPR or does it also require a further (objective or subjective) restriction and/or (significant) damage to the data subject? II. The parties disagree on claims under the law on the protection of personal data and whether those claims constitute an abuse of right. The applicant, a family run optician company established in Arnsberg, North Rhine-Westphalia, is seeking a declaration that the defendant, a private individual living in Vienna, is not entitled to compensation in the amount of EUR 1 000. On 16 March 2023, the defendant subscribed to the ‘newsletter’ on the applicant’s website by entering his personal data in the registration form, confirming his consent to data processing by ticking a box and submitting the form. On 29 March 2023, the defendant sent by fax an information request pursuant to Article 15 of the GDPR. The applicant acknowledged receipt of the request and stated that it would respond to it within the one-month period. However, by letter of 26 April 2023, the applicant refused to provide the information since it classified the information request as an abuse of right for the purposes of the second sentence of Article 12(5)(b) of the GDPR. The defendant was requested finally to abandon his claim by 3 May 2023, otherwise the matter would be referred to a lawyer. The defendant did not comply with that request and pursued his claim for information and a claim for damages under Article 82 of the GDPR. By letter of 29 June 2023, he requested compensation of EUR 1 000. The parties disagree as to whether the defendant is asserting claims under the law on the protection of personal data in an abusive manner. The applicant claims that the defendant systematically and abusively uses information requests under the law on the protection of personal data in order

REQUEST FOR A PRELIMINARY RULING OF 31. 7. 2024 – CASE C-526/24

4 Anonymised version subsequently to assert claims for damages. This is apparent from a number of reports in relevant online media, which document the defendant’s conduct in many cases. The applicant bases its view on various blog posts and reports by lawyers who describe similar cases and termed the defendant’s conduct ‘business- like’. It further argues that the defendant’s conduct undermines the protective purpose of the GDPR since he is not concerned with the protection of his personal data, but solely with extorting financial compensation. In that regard, the applicant refers to the order of the Oberlandesgericht Hamm (Higher Regional Court, Hamm), according to which abusive requests do not establish that a claim for information exists (Oberlandesgericht, Hamm, order of 15 November 2021 – 20 U 269/21). According to the applicant, the defendant is not actually affected since he deliberately provokes infringements of the law relating to the protection of personal data. The applicant bases its claim on reports from lawyers which document the defendant following the same pattern in a large number of cases: subscription to a newsletter, information request and a subsequent claim for damages. The applicant has submitted various blog posts and online reports as evidence. The defendant takes the view that his information request is not an abuse of right. He claims that the request is legitimate and is consistent with his right to information under Article 15 of GDPR. The defendant points out that the right to information is not linked to the applicant’s motives and that any data subject can assert that right unconditionally. He bases that view on the case-law of the Court of Justice, which has emphasised the scope and unconditionality of the right to information (Court of Justice of the European Union, judgment of 9 September 2021, C-33/20, C-155/20 and C-187/20). The defendant further argues that the applicant is seeking to restrict his rights under the GDPR unlawfully and that he therefore has a claim for damages under Article 82 thereof. In addition, the defendant points out that he is regularly in Germany – in particular in Düsseldorf and Munich – and therefore has a legitimate interest in the applicant’s newsletter. The defendant denies the claims relating to the abusive use of claims under the law on the protection of personal data and invokes the fundamental right to information under Article 15 of the GDPR, regardless of the applicant’s motives. The Court of Justice has emphasised in several decisions that the right to information can be exercised comprehensively and without conditions (Court of Justice, judgment of 9 September 2021, C-33/20, C-155/20 and C-187/20). The defendant also points out that the applicant did not provide him with the transparency required under Article 12 of the GDPR in that it failed to explain sufficiently the reasons for the refusal of his information request. On 25 September 2023, the defendant lodged a counterclaim. The applicant claims that

BRILLEN ROTTLER

5 Anonymised version 1. the defendant should be declared to have no claim against the applicant for payment of compensation in the amount of EUR 1 000, 2. the defendant should be ordered to pay the costs of the proceedings and 3. the judgment should be declared provisionally enforceable – if necessary on provision of security. The defendant contends that 1. the action should be dismissed and 2. in response to the counterclaim, the applicant should be ordered to, a. provide the defendant with a copy of all personal data which the applicant processes about the defendant, b. provide the defendant with information about the processing purposes for which the applicant processes the defendant’s personal data, c. provide the defendant with information about the recipients of his data to whom the applicant has transmitted the defendant’s personal data, d. provide the defendant with information as to whether the applicant has carried out automated decision-making or profiling with regard to the defendant’s personal data, e. pay the defendant pecuniary compensation for non-material damages, the amount of which is at the discretion of the court, but should not be less than EUR 1 000.00, and f. pay pre-trial costs in the amount of EUR 719.95, plus default interest in the amount of five percentage points above the applicable base rate on EUR 1 719.95 5 from the commencement of proceedings. At the hearing held on 15 October 2023, the parties once again discussed the facts of the case in detail. The applicant reiterated that the defendant’s requests were systematic and abusive and in that regard relied on further media reports. The defendant rejected those claims and argued that his information request was legitimate and lawful. The court decided to refer the questions set out in point I. to the Court of Justice of the European Union (‘Court of Justice’) for a preliminary ruling pursuant to Article 267 of the Treaty on the functioning of the European Union (TFEU): Proceedings have been stayed pending the decision of the Court of Justice. III.

REQUEST FOR A PRELIMINARY RULING OF 31. 7. 2024 – CASE C-526/24

6 Anonymised version The outcome of the dispute turns on the interpretation of EU law. 1. Provisions of national law, in particular Paragraph 34 of the Bundesdatenschutzgesetz (Federal law on data protection; ‘BDSG’), Paragraph 242 of the Bürgerliches Gesetzbuch (Civil Code; ‘BGB’) and Paragraph 226 of the Zivilprozessordnung (Code of Civil Procedure; ‘ZPO’) are not relevant in the present case. Paragraph 34 of the BDSG sets out the obligations to provide information in German law relating to the protection of personal data and could be used as a supplement to specify the requirements concerning information. However, as a European regulation, the GDPR is subject to the primacy of EU law and therefore provisions of national law such as Paragraph 34 of the BDSG are not decisive, but can only be used as an aid to understanding the GDPR. The court also does not consider Paragraph 242 of the BGB (good faith) to be relevant since the GDPR takes precedence in this context. Paragraph 242 of the BGB concerns the principle of good faith and is applied in German law to prevent conduct constituting an abuse of rights. Since this case concerns the interpretation of EU law and more specifically the GDPR, rules of national law such as Paragraph 242 of the BGB are not directly applicable. The same applies to Paragraph 226 of the ZPO, which lays down the prohibition on acting contrary to good faith in the procedural area. That paragraph aims to prevent abusive conduct in civil proceedings, but is not directly applicable to the interpretation of the GDPR. 2. The court has doubts regarding the interpretation of EU law. The outcome of the national dispute depends on the interpretation of Articles 4(2), 15(1), and 82(2) of the GDPR in particular. The court has doubts as to the interpretation of EU law, in particular with regard to the following points: It is unclear whether there can be an excessive information request from the data subject when the first request is made to the controller. The wording of the second sentence of Article 12(5) of the GDPR is not clear in that regard and there is no clear guidance from the previous case-law of the Court of Justice. Furthermore, in connection with the second sentence of Article 12(5) of the GDPR, the question arises as to whether the controller can refuse an information request from the data subject if the data subject intends to use the information

BRILLEN ROTTLER

7 Anonymised version request to provoke claims for damages against the controller. The GDPR contains no explicit provisions on how to deal with requests that may be made in bad faith. There are also doubts about the interpretation with regard to publicly available information about the data subject which suggests that the data subject is asserting claims for damages against the controller in a large number of cases of infringement of the law relating to the protection of personal data, which can provide grounds for refusing to provide information. This concerns the question of the extent to which publicly available information about the conduct of the data subject may be used as a basis for assuming an abuse of right. It also depends on the interpretation of the GDPR whether a data subject’s information request from the controller pursuant to Article 15(1) of the GDPR and/or the response to such a request constitutes processing within the meaning of Article 4(2) of the GDPR. This concerns the definition of processing and its application to requests and responses. Another essential question concerns eligibility for compensation under Article 82(1) of the GDPR: It must be clarified whether only damage which the data subject suffers or has suffered as a result of processing is eligible for compensation. The first sentence of recital 146 of GDPR could have a restrictive effect in this case, but there is no clear interpretation by the Court of Justice. Finally, the question arises as to whether the data subject has a claim for compensation under Article 82(1) of the GDPR solely on the basis of an infringement of his right to information under Article 15(1) of the GDPR. There are no precise provisions on this in the GDPR and no corresponding case-law of the Court of Justice. The questions submitted are also related to provisions of national law which are not directly applicable here, but can be used to determine the context of EU law. In German law, the concept of abuse of right is used in various contexts, for example in the area of civil law (Paragraph 242 of the BGB – good faith). That provision could be applied mutatis mutandis to shed light on the concept of abuse of right in the context of EU law. Provisions of national law which govern the abuse of procedural rights, such as Paragraph 226 of the ZPO (prohibition on acting contrary to good faith), can provide guidance. Those rules offer bases for determining when exercise of rights is to be classified as abusive. The BDSG contains rules on transparency and obligations to provide information which could be used as a supplement to the GDPR to specify the requirements concerning information. Those provisions of national law provide points of reference and interpretative aids to better understand the unanswered questions regarding the interpretation of EU law and to ensure consistent application. However, definitive clarification is only possible through a preliminary ruling by the Court of Justice, which is why these questions have been referred for a ruling. IV.

REQUEST FOR A PRELIMINARY RULING OF 31. 7. 2024 – CASE C-526/24

8 Anonymised version The assessment of the merits of the action depends on the answer to the questions referred, which have not already been clarified or answered beyond doubt by the case-law of the Court of Justice. 1. Question 1 In view of recitals 63 and 64 of the GDPR, the court does not completely rule out the possibility that an excessive request may be possible in an individual case, even in the case of an initial information request, but having regard to Article 5(1)a) of the GDPR it is conceivable only in very exceptional cases. If the requirement relating to an excessive request were interpreted too liberally, that would lead to a curtailment of the data subject’s rights and a lack of transparency. As long as his or her personal data are purportedly processed by a controller, the data subject must have the right to information in accordance with Article 15 of the GDPR. 2. Question 2 The court considers that a refusal of the information request by the controller solely on account of the data subject’s intention to prepare claims for damages is not permissible. Any other interpretation would be tantamount to forfeiting the right to information. A data subject who may have requested information about the processing in an abusive manner in the past must nevertheless retain that possibility in light of the interests to be protected under the GDPR. Furthermore, it is a legislative decision, which must be respected, to ensure the lawfulness of the processing of personal data by the respective controllers in such a way that the controllers must be accountable to all data subjects for processing solely within the limits of abuse. 3. Question 3 In the light of the foregoing and the resulting risk of abuse by the relevant controller and also the associated curtailment of the rights of the data subject, the referring court does not consider that the reference to public information, which shows that the data subject is making a large number of information requests, is sufficient in itself to provide grounds for an abuse of right or the non-provision of information. 4. Question 4 The court provisionally assumes that, although Article 4(2) of the GDPR can be interpreted as meaning that the receipt of, processing of and response to each information request pursuant to Article 15 of the GDPR involves the processing of personal data, the information request does not in itself constitute processing. The court finds that Article 6(1)(c) of the GDPR, in conjunction with Article 15 thereof, provides grounds for the processing required by the information request. 5. Question 5

BRILLEN ROTTLER

9 Anonymised version The court assumes that any infringement of the GDPR is capable of providing grounds for a claim for damages, assuming that the data subject has suffered causal damage as a result of the infringement. In the view of the court, the processing of personal data is not required for a claim under Article 82(1) of the GDPR. The court infers this, inter alia, from the wording of Article 15(1) of the GDPR, which also includes the negative information that no data are being processed. 6. Question 6 Accordingly, the court considers it possible that the data subject may have a claim for damages under Article 82(1) of the GDPR as a result of the infringement of his right to information. 7. Question 7 The court considers that it is a legislative decision, which is to be respected, that information requests can be aimed at uncovering infringements of the GDPR. The court therefore considers that the assertion of claims for damages by the data subject in the event of an infringement of the GDPR by the controller is legitimate in principle. 8. Question 8 In cases where the data subject (as established by a court) is concerned with the ‘loss of control’, the court assumes that non-material damage cannot be derived solely from the loss of control, but that an additional impairment of the data subject must be demonstrated, which does not have to exceed a de minimis threshold. However, the enforcement of the right to information by the data subject, for example, consulting a legal adviser, can provide grounds for material damage. […]