A Dutch court has rejected GDPR access claims brought by one individual against four retailers. It found the requests were part of a scheme to extract compensation.
The District Court of Noord-Holland ruled in late July in cases against Suitable, Scapino, At Home and Wolters Wonen/Fundesign. All four claims were declared inadmissible.
The method was the same each time, according to ICTRecht’s analysis of the judgments. The applicant placed an online order or signed up for a newsletter. An Article 15 access request followed shortly after. Within weeks came a demand for €925 in extrajudicial costs, then a settlement proposal under threat of a summons. The summons claimed substantial damages plus costs. Just before the hearing, the claim was cut back to access alone, without a proper explanation.
The applicant told the court he had filed around 90 access requests in 18 months. Around 20 cases were pending in Noord-Holland, with more in Rotterdam and Midden-Nederland. The court also doubted that the representatives named in his filings existed. None ever appeared at a hearing.
The court held that he had knowingly constructed a situation that let him use the GDPR to pursue damages. It added that he appeared to be exploiting businesses’ unfamiliarity with the regulation and their fear of large awards.
These are the first Dutch rulings to apply the CJEU’s Brillen Rottler v TC judgment of 19 March 2026. That case also began with a newsletter signup followed by an access request. The CJEU held that even a first request can be excessive under Article 12(5) where the requester has artificially created the conditions for a financial advantage.
Two procedural points matter for anyone defending a similar claim. Scapino never argued abuse of rights, and the court found it anyway of its own motion. Costs went to those who asked properly. Suitable recovered €7,047.97 in actual legal costs because it submitted a budget. Wolters/Fundesign submitted none and received €2,230 at the standard rate. Counterclaims for damages failed because nobody had quantified their loss.
Senders should read this narrowly. The court stressed that the bar for abuse is high, and the pattern here was extreme. A single awkward request from an unknown subscriber still needs a proper answer. The indicators the court relied on were data volunteered shortly before the request, early cost demands, near-identical summonses across dozens of cases and similar requests to many other controllers. Spotting that pattern depends on records: signup source and timestamp, consent, and a log of how each access request was handled.