job applicant (data subject) – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A job applicant's request to delete their personal data was denied by the company after they were not hired. This is significant because it shows that companies must have valid reasons for keeping personal data. Businesses should understand their responsibilities regarding data retention and erasure.
What happened
The company refused to delete the job applicant's personal data after they were not selected for the position.
Who was affected
The job applicant whose data was retained by the company was affected.
What the authority found
The court ruled that the company's retention of the applicant's data was lawful under GDPR, but the applicant's request for deletion was not upheld.
Why this matters
This ruling highlights the importance of having valid legal grounds for retaining personal data. Companies should regularly assess their data retention policies to ensure compliance.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
On 13. January 2024, the data subject applied for an IT system administrator position and provided additional documents, regarding the use of their personal data. Among other things, it was stated that the data subject's information would be considered as intellectual property, and further processing or reproduction would constitute an intentional criminal offence. Furthermore, an extended retention period for their personal data would have no valid legal basis and non-compliant behaviour would result in legal consequences. On 24. January 2024, the controller notified the data subject that the position had already been allocated, and informed them about the duration and the purpose of their data being processed. In response, the data subject requested the deletion of their data, but the controller refused, stating that they and the second controller as their legal counsel would retain the additional documents in order to defend any legal claims that the data subject might make. Only the first controller retained the data subject's CV and deleted the document 7 months after the date of the job refusal, as mentioned in their privacy policy. On 29. February 2024, the data subject lodged a complaint with the DPA regarding the violation of their right to erasure, which the DPA dismissed. Then, the data subject appealed against this decision on 23. December 2025. First, the court held that the retention of the data subject's data was lawful under Article 6(1)(f) GDPR in order to protect against legal claims threatened by the data subject. The first controller informed the data subject at the earliest opportunity about the further course of the processing of their data. Furthermore, as the data subject had announced possible legal action, it was necessary to retain certain documents as evidence for their legal defence. In this case, it was evident that the legitimate interests of the controllers outweighed the data subject's fundamental rights. Thus, all three cumulativ
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for job applicant (data subject) in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. job applicant (data subject) - Austria (2026). Retrieved from cookiefines.eu
Last updated: