DPA case 7286-1/2023 – Complaint Upheld (Hungary, 2023)

On 07 April 2022, the data subject received an e-mail from a recruiter, the controller, mentioning the data subject’s standout resume among job seekers’ profiles. It was unclear to the data subject how the controller obtained access to his contact information as he never disclosed it on the jobseeker’ website which is generally used by the recruiters to directly contact the candidates. Therefore, data subject asked the controller for an explanation based on Article 15 GDPR. Despite reminders, no response was received. The data subject requested the DPA to investigate the controller’s conduct and compel them to respond. Additionally, the data subject requested to investigate the relationship between the website operator and the recruiter and whether a joint liability could be established. The controller declared to the DPA that they were registered on the jobseekers’ website as an independent data controller to carry out recruitment activities. Additionally, the data subject provided his consent to be contacted for recruitment purposes on the website. The controller had access to the data subject's e-mail address as a subscriber to the website. The controller attributed the lack of response to the data subject's request to an administrative error, specifically, the misspelling of their email address in the response sent on 17 May 2022. This oversight came to light subsequent to the order from the DPA to address the allegations. The DPA held that the controller’s argument did not relieve them of their liability as a controller under Article 4(7) GDPR. The DPA highlighted that the most important characteristic of a controller is that they have substantive decision-making power and responsibility for compliance with all the obligations of the processing laid down in the GDPR. Despite the fact that controller intended to comply with the data subject’s access request under Article 15 GDPR, the DPA observed that this provision was violated. The controller sent the re