Article 12

5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also, for requests under Article 15 because the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.

Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or also,because forthere requestsare underreasonable Articlegrounds 15to becausebelieve that the datarequest subjecthas abusesbeen the rights conferred by this regulationsubmitted for purposes other than the protection of theirthat subject’s personal data, the controller may either:

The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’Data controllers, notably SMEs, may also refuse a request if the data processing poses a limited risk to the rights and freedoms of the data subject and if the request is not commensurate with the risks that such data processing entails. If the controller refuses to comply with a request on the grounds referred to in this Article, the data subject must demonstrate that the request is legitimate, where applicable.’

Justification

SMEs are increasingly having to deal with vexatious or disproportionate requests, which entail considerable administrative costs while availing nothing for data protection. Beyond reimbursing those costs and rejecting manifestly unfounded requests, further safeguards are needed to refuse requests that are disproportionate and pose a minimal risk and to ensure that the burden of proof does not solely reside with the controller. Requiring the data subject to demonstrate that their request is legitimate would protect SMEs from vexatious requests while upholding the guarantees provided by the Regulation.