Decision of the CJEU from 20.03.2026 in the context of Art. 82 GDPR
The Court of Justice of the European Union (CJEU) clarified in its judgment from 20.03.2026 (Case C‑526/24) that a claim for damages under Art. 82 GDPR is not justified merely because a request for information under Art. 15 GDPR can be deemed abusive or the right to information is used for purposes unrelated to the subject matter. What remains decisive is whether there is a violation of the GDPR, a damage has occurred, and there is causation between the two.
Starting point of the proceedings
Request for information and subject of dispute
The proceedings were based on a scenario where an affected individual requested data protection information and subsequently asserted claims. The dispute centered on whether the mere fact of a request for information perceived as abusive or its purpose direction has an impact on a possible claim for damages under Art. 82 GDPR.
Procedural situation and classification
The CJEU dealt with the issue within the framework of a preliminary ruling procedure. It concerned the interpretation of the GDPR’s EU law provisions; the specific fact-finding and decision on claims in individual cases remain with the national courts.
Core statements of the CJEU on Art. 82 GDPR
No “sanction” via Art. 82 GDPR
According to the decision, Art. 82 GDPR is not to be understood as an instrument to “punish” abusive behavior of the applicant or to open access to compensation solely because of a motivation considered inadmissible. The claim serves to compensate for damage suffered as a result of a GDPR violation; it does not replace an independent abuse or penalty regulation.
Required: Violation, damage, and causality
The CJEU bases its decision on the fact that a claim for damages meets the classic requirements: there must be a violation of the GDPR, a material or non-material damage, and a causal link between the violation and the damage. An abusive nature of the request for information does not change this claim systematics.
Abuse can gain significance within the specific examination
At the same time, the decision shows that the abusive use of the right to information does not automatically lead to a claim for compensation. The assessment of whether and to what extent a claim exists remains oriented towards the statutory elements and is to be made based on the circumstances of the individual case.
Significance for the practice of data protection information and compensation claims
Relationship between Art. 15 GDPR and Art. 82 GDPR
The decision illustrates the separation of the right to information and compensation: The right to information under Art. 15 GDPR is designed as a right of the data subject; the compensation obligation under Art. 82 GDPR, on the other hand, is linked to a concrete GDPR violation with damage consequences. The motivation behind a request for information is therefore not the sole criterion for the compensation obligation.
Relevance of individual cases and judicial assessment
The CJEU provides the framework within which national courts must examine the requirements of Art. 82 GDPR. Whether a violation, a compensable damage, and the required causality are established in the respective proceedings is to be judged based on the established facts.
Classification from the perspective of MTR Legal
The CJEU’s judgment (C‑526/24) emphasizes that compensation under the GDPR remains bound to specific statutory requirements and does not depend on whether a request for information is classified as abusive. For companies, investors, and wealthy private individuals, this may be relevant when assessing information and liability issues in data protection law. If clarification is needed, you will find further information on legal advice in data protection at MTR Legal Rechtsanwälte.
