Last Update: 04/05/2026 at 2:50 PM EST

CJEU Tightens GDPR Notice And Access Rules

Coverage from ICTRecht, Ropesgray, and others

Articles

5

Latest Article

03/23

Active Days

29

Executive Summary

EU courts tighten GDPR transparency and access rules, covering bodycam notices and limits on abusive subject access requests

  • Body-worn cameras in Swedish public transport were held to trigger GDPR Article 13 duties
  • The Court said camera observation can count as data collected directly from the filmed person
  • Layered notice is allowed if key information is given through signs and accessible channels
  • The ruling warns against covert surveillance and reinforces transparency for video monitoring
  • The CJEU held that a first subject access request can be excessive under Article 12(5)
  • Controllers may refuse manifestly unfounded or excessive requests if they prove abusive intent
  • Article 82 compensation still requires actual damage and a causal link

Quick Facts

  • What: Tightened GDPR notice and access request rules
  • Where: European Union, including Swedish and Dutch cases
  • Why: To reinforce transparency and curb abusive rights use
  • Who: CJEU, controllers, and data subjects
  • When: March 2026 rulings and related appeals

Coverage Timeline: 29 Days

1Feb 23 '261Feb 251Mar 181Mar 191Mar 23 '26

Featured Article

Inside Privacy / Kristof Van Quathem 03-23-2026
A court ruling clarifies when GDPR Article 12(5) deems access requests excessive and when Article 82 compensation for access-right violations can be denied due to broken causality.

Additional Articles

⭐⭐⭐⭐⭐

ICTRecht / Paul Bex 02-23-2026
EU Court rules that bodycam data collection triggers GDPR Article 13 notices in Swedish public transport case.
Ropesgray 03-19-2026
On 19 March 2026, the CJEU ruled that GDPR Article 12(5) can justify refusing even a first subject access request when controllers demonstrate abusive intent and break causation for Article 82 claims.
Lewis Silkin / Michael Charalambous 02-25-2026
france court of appeal clarifies gdpr article 15 dsar scope restricting access to substantive personal data in work emails.

⭐⭐⭐

Courthouse News Service / Eunseo Hong 03-18-2026
An EU court ruled in a GDPR case involving a German optician and a customer that refusal of data access requests requires proof of abusive intent.