The Nuremberg Higher Regional Court (OLG) has ruled with Judgment of 13 July 2021 like other dishes before ruled that the GDPR recognizes a general prohibition of abuse of rights with regard to data subject requests:
(4) Finally, the asserted right to information does not arise from Article 15 (1) of the GDPR. This is because the defendant has a right of refusal under Article 12 (5) sentence 2 lit. b) GDPR. The provision merely lists frequent repetition as an example of an “excessive” request. The use of the word “in particular,” however, makes it clear that the provision also intends to cover other abusive applications […].
Interesting: Sedes materiae is not Art. 15 GDPR, but rather Art. 12 para. 5 DSGVOwhich refers not only to Art. 15 GDPR (right of access), but also to the information obligation under Art. 13 and 14 GDPR and the other data subject rights (Art. 16 – 22), and also to Art. 34 (notification of a data breach). For all of these claims, the data controller can therefore invoke abuse of rights, provided that the conditions are met in detail (which will primarily apply to the right of access).
The Abuse of rights must then be measured against the protective purpose of the GDPR, among other things:
When interpreting what constitutes abuse of rights in this sense, the protective purpose of the GDPR must also be taken into account. As can be seen from recital 63 of the Regulation, the purpose of the right to information standardized in Art. 15 GDPR is to enable the data subject to obtain it easily and at reasonable intervals, Be aware of the processing of personal data concerning them and be able to verify the lawfulness of such processing […]. However, the plaintiff is obviously not concerned with such an awareness for the purpose of reviewing the permissibility of the processing of personal data under data protection law. The purpose of the information he is seeking is rather – as is clear from the combination with the inadmissible claims for a declaratory judgment and payment – to Exclusively reviewing any premium adjustments made by the defendant. due to possible formal deficiencies pursuant to Section 203 (5) WG. However, such an approach is not covered by the protective purpose of the GDPR […].
This case law coincides with that of the Federal Court to Art. 8 DPA.