job applicant (data subject) – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian job applicant's request to delete their personal data was denied after they applied for a position. The company wanted to keep the data to defend against potential legal claims. This case illustrates the balance between job applicants' rights and employers' needs.
What happened
The court ruled that the company could retain the job applicant's data to defend against possible legal claims.
Who was affected
The job applicant who requested the deletion of their personal data after being rejected for a position.
What the authority found
The court decided that retaining the applicant's data was lawful for the purpose of defending against legal claims.
Why this matters
This case highlights the tension between an individual's right to erasure and a company's need to retain data for legal reasons. It serves as a reminder for businesses to have clear policies on data retention.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 25 August 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject applied for a job with the association and provided additional documents, regarding the use of their personal data. Among other things, it was stated that the data subject's information would be considered as intellectual property, and further processing or reproduction would constitute an intentional criminal offence. Furthermore, an extended retention period for their personal data would have no valid legal basis and non-compliant behaviour would result in legal consequences, and the data subject objected to the retention. The controller notified the data subject that the position had already been allocated, and informed them about the duration and the purpose of their data being processed after the rejection for the purpose of possible legal claims against the rejection, as provided for by national law. In response, the data subject requested the deletion of their data, but the controller refused, stating that they would retain the additional documents in order to defend possible legal claims by the data subject. After seven months and in accordance with their privacy policy, the data controller deleted the data. The data subject lodged a complaint with the DPA regarding the violation of their right to erasure, which the DPA dismissed. Then, the data subject appealed against this decision. First, the court held that the retention of the data subject's data was lawful under Article 6(1)(f) GDPR for the purpose of defence against possible legal claims by the data subject concerning the rejection of their application, irrespective of the fact that the data subject renounced taking any legal action. The court held that the data subject was aware of the controller's processing practices due to their privacy policy that mentioned the retention period, as they voluntarily and in their own interests applied for the job position. Since the data subject tried to prevent the retention of seven months by pro-actively objecting to the retention at the ti
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for job applicant (data subject) in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. job applicant (data subject) - Austria (2026). Retrieved from cookiefines.eu
Last updated: