Privacy Law and Privacy Regulations

In its March 19, 2026, judgment in Case C-526/24 (Brillen Rottler), the CJEU ruled that even a first request for access to personal data under the GDPR may be deemed abusive if not made in good faith.

On February 23 2026, the Spanish supervisory authority (AEPD) published an article containing recommendations on operational sovereignty when processing personal data. This follows a major incident on October 20 2025, where a cloud provider experienced technical issues in the United States which affected services globally.

In its recent judgment in Brillen Rottler (C-526/24), the European Court of Justice addressed this question directly, confirming that — in certain circumstances — even a first access request may be considered abusive...