AG de la Tour’s Opinion on ‘Excessive’ GDPR Complaints

On 5 September 2024, Advocate General Richard de la Tour provided an opinion in the case Österreichische Datenschutzbehörde (C-416/23), clarifying whether a large number of complaints filed in a short time can be automatically considered “excessive” under the GDPR. The case originated when the Austrian Data Protection Authority (DSB) declined to act on 77 complaints filed by a data subject within 20 months, citing the burden these complaints placed on its resources.

Key Issues Raised

The Austrian court raised three key questions concerning GDPR Article 57(4):

1. Do ‘requests’ include ‘complaints’? De la Tour confirmed that “requests” under Article 57(4) should indeed include complaints submitted under Article 77(1).
2. Does a large volume of complaints make them ‘excessive’? He argued that simply submitting many complaints is insufficient to deem them excessive. Instead, data protection authorities (DPAs) must show that the complainant acted with an abusive intention. Submitting multiple complaints for different controllers is not inherently excessive if the rights of the data subject are at stake.
3. Can DPAs choose to charge a fee or refuse to act? The AG stated that DPAs have the discretion to either charge a reasonable fee based on administrative costs or refuse to act, but must carefully assess the circumstances before deciding. Charging a fee may be a less restrictive approach than outright refusal.

Conclusion

The Advocate General concluded that DPAs should prioritize charging a reasonable fee rather than refusing complaints outright, as doing so aligns better with GDPR’s goal of ensuring high data protection. This opinion supports the idea that excessive complaint thresholds must be carefully evaluated, requiring proof of abuse rather than being based solely on quantity.

Read it here.