In response to questions formulated by the German Amtsgericht of Arnsberg, the ECJ ruled that a first DSAR may be regarded as ‘excessive’, within the meaning of Article 12(5) GDPR, where the data controller demonstrates that, despite formal observance of the conditions governing DSARs, the request was made by the data subject:

• not for the purpose of being aware of the processing of their data and verifying the lawfulness of that processing in order to be able, subsequently, to obtain protection of their rights under the GDPR (right to rectification, right to erasure or right to restriction of processing, right to object and right of action where the data subject suffers damage),
• but instead with an abusive intention, such as that of artificially creating the conditions laid down for obtaining an advantage from the GDPR.

The ECJ considers that the meaning of “excessive requests” needs to be interpreted in its “everyday language” and that a first request may thus indeed be excessive. The ECJ confirms that the application of EU legislation cannot be extended to cover transactions carried out for the purpose of fraudulently or wrongfully obtaining advantages provided for by EU law.

Proof of an abusive practice requires:

• a combination of objective circumstances in which, despite formal observance of the conditions laid down by the EU rules governing DSARs, the purpose of those rules has not been achieved; and
• a subjective element consisting of the data subject’s intention...

Read Full Story: https://news.google.com/rss/articles/CBMi4wFBVV95cUxQNWNja2F3blNJLS1xc2JWWXNB...