The EU Court of Justice has clarified that even a first access request under Art. 15 GDPR can constitute abuse of rights if it aims exclusively at damages; companies can refuse such requests but must meet high evidentiary requirements, and data subjects can claim damages if violation of the right of access causes immat