CJEU Ruling: First-Time DSAR Refusal Allowed

According to the DLA Piper report, the CJEU confirmed two significant points.

First, a first-time DSAR can be refused as "excessive" under Article 12(5) GDPR if the controller can demonstrate abusive intent. The court reportedly clarified that the reference to "repeated requests" in Article 12(5) is just one example of excessiveness, not the only one. The key question is whether the request was made with the intention of engineering the conditions for a compensation claim, not simply how many requests were submitted.

Second, on the question of compensation under Article 82 GDPR, the court reportedly ruled that the causal link required for a compensation claim can be broken where the data subject's own conduct is the primary driver of the alleged harm.

Because the source is a secondary blog post rather than the primary judgment text, these details should be treated with some caution until the full ruling is available.

What does this mean for your website?

If someone signs up to your mailing list or contact form and then quickly sends a DSAR, you do not automatically have to comply without question. However, refusing a request is not straightforward: you would need to be able to demonstrate abusive intent, and getting that wrong could still expose you to a complaint. If you want to make sure your DSAR process is solid, our GDPR compliance checklist and guide to privacy policy requirements are good places to start.