job applicant (data subject) – Court Ruling (Austria, 2026)

The data subject applied for a job with the association and provided additional documents, regarding the use of their personal data. Among other things, it was stated that the data subject's information would be considered as intellectual property, and further processing or reproduction would constitute an intentional criminal offence. Furthermore, an extended retention period for their personal data would have no valid legal basis and non-compliant behaviour would result in legal consequences, and the data subject objected to the retention. The controller notified the data subject that the position had already been allocated, and informed them about the duration and the purpose of their data being processed after the rejection for the purpose of possible legal claims against the rejection, as provided for by national law. In response, the data subject requested the deletion of their data, but the controller refused, stating that they would retain the additional documents in order to defend possible legal claims by the data subject. After seven months and in accordance with their privacy policy, the data controller deleted the data. The data subject lodged a complaint with the DPA regarding the violation of their right to erasure, which the DPA dismissed. Then, the data subject appealed against this decision. First, the court held that the retention of the data subject's data was lawful under Article 6(1)(f) GDPR for the purpose of defence against possible legal claims by the data subject concerning the rejection of their application, irrespective of the fact that the data subject renounced taking any legal action. The court held that the data subject was aware of the controller's processing practices due to their privacy policy that mentioned the retention period, as they voluntarily and in their own interests applied for the job position. Since the data subject tried to prevent the retention of seven months by pro-actively objecting to the retention at the time of submitting the application, the data subject reasonably expected the retention of their application after the rejection. . The controller rightfully informed the data subject at the earliest opportunity about further processing of their data, namely upon rejection of their application. The controller was not obliged, according to the court, to inform the data subject about further processing at the time of the initial data collection. It was sufficient to inform them at the time of further processing. The retention period that was prescribed by national law, could not be waived by the parties. The court held that there was no other obligation to delete the data subject's data under Article 17(1) GDPR. The processing of the data was lawful under Article 6(1) GDPR in conjunction with Article 5(1)(a) GDPR for the above mentioned reasons.