The European Court of Justice (ECJ) clarified in its ruling of January 9, 2025 (Case No.: C-416/23) under what circumstances consumer requests to data protection authorities can be deemed excessive and what measures authorities may take in such cases. The ruling provides supervisory authorities with guidelines on how to handle a large number of complaints without restricting citizens’ rights.
What Was the Case About?
An individual had submitted a large number of complaints to the Austrian data protection authority regarding alleged GDPR violations. The authority refused to process these complaints, classifying them as excessive. The person in question had filed a total of 77 complaints within 20 months.
How Did the Court Rule?
The Austrian Federal Administrative Court overturned this decision, arguing that the sheer number of requests is not enough to classify them as excessive. Instead, an intent to abuse the system must be proven.
- A high number of complaints alone does not justify labeling them as excessive.
- The data protection authority must demonstrate that the complaints were filed with the intent to disrupt or overload the authority’s operations.
- The ability to file complaints is a fundamental GDPR mechanism and must not be arbitrarily restricted.
However, in cases where excessive requests are submitted with abusive intent, the authority may:
- Charge a fee based on administrative costs, or
- Refuse to take action on the request.
These measures must be proportionate, well-justified, and consider all relevant circumstances.
Implications for Practice
This ruling has the following consequences:
- Burden of Proof on Authorities: Data protection authorities must prove that a complaint is excessive due to an intent to abuse the system, not merely because of its quantity.
- Proportionality of Measures: Authorities must act proportionately when handling excessive requests and provide justification. Blanket rejections without proper review are not permissible.
Summary
The ECJ ruled that a high number of complaints alone does not justify classifying them as excessive. Authorities must prove an intent to abuse the system. In cases of excessive requests, authorities may impose fees or refuse to process them, but they must always act proportionately.
