Case C-307/22: The GDPR Fine Line Between Access and Abuse

Abstract

Abstract: It stands as a common practice for service providers to collect the personal data of clients or patients. At the same time, it becomes just as common for thee data subjects to have access to what is stored about them, sometimes via a “data subject access request”, as the GDPR names it in Article 15. In this context, Case C-307/22 (founded on such a request from a patient against their dentist) delineated when abusive data subject access requests occur, including the limits of the data controller’s refusal to comply with it or the decision to charge for the act of complying.As part of the case, the CJEU pinpointed the solution for the conflict between the GDPR and the German data protection implementation law, the reiteration of Recitals’ value in terms of GDPR applicability and the right of access as a tool in triggering medical liability. Correspondingly, the case note will explore the repercussions of this case at both doctrinal and legislative level, since the decision’s interpretation may come into conflict with national data protection laws.On this point,Greece and France will be the relevant jurisdictions for the analysis, since Article 12 of the GDPR was slightly amended in their data protection laws by introducing the concept of “abusive” requests. Furthermore, the implications towards Private Lawwill also be addressed, with particular focus onContract Law, Property LawandTort Law.Substantially, the case note depicts how inconsistency may arise from attempted consistency, compelling the data protection legal apparatus to restructuring.