The Abuse & Misuse of the GDPR Right of Access: Refining the Sharp Edges of the Digital Omnibus Proposal // WINNER

The General Data Protection Regulation (GDPR) was subject to thorough scrutiny through the EU Digital Omnibus proposal. One of the most controversial points was regulating the abuse of the right of access, bringing a number of practical and theoretical incompatibilities to light. This article will detail them, subsequently proposing an interpretative solution for harmonisation, with minimal regulatory costs.
This contribution employs doctrinal and comparative legal analysis, supplemented where appropriate by non-EU examples. It applies the abuse of rights doctrine to strengthen data controllers’ mechanisms for countering malicious access requests. This approach establishes a dual framework distinguishing between abuse and misuse of the right of access under Article 15 GDPR. Using practical examples, it is proposed that the two concepts are defined through legitimacy: abusing this right would mean exercising it outside the sphere of the law (e.g. concealing malware attacks), whereas misusing it would entail legitimate purpose, even beyond data protection (e.g. research, evidence gathering).
Simultaneously, a revitalised perspective on the objective-subjective test for assessing abuse of access rights is provided, under which the requester’s motivation is relevant only insofar as it falls within or outside the bounds of legitimacy, avoiding a ‘shield’ for blanket refusals.