DPA case DPA 2021-0.415.529 – Complaint Upheld (Austria, 2021)

The data subject was registered as a jobseeker with the Austrian Public Employment Service. The data subject received unsolicited job offers from a company (“the controller”) by text message, whereby the company had informed the data subject by telephone that it had received the data subject’s contact details from the Austrian Public Employment Service (“AMS’). The data subject emailed the controller with a request for erasure, but received no response from the controller. The data subject continued to receive further text messages with job offers from the controller. The data subject then lodged a complaint with the Austrian DPA (“Datenschutzbehörde”). The controller argued that since the data subject had had been registered as a jobseeker with the AMS at the time of the first contact, it was not considered unlawful to send a job offer to the data subject. It therefore had a right to process the data subject’s data for the purposes of its business and thus had legitimate interests under Article 6(1)(f) GDPR. The controller did not address the issue of the data subject's right to erasure in its statement. The data subject stated that they did not question the legality of the collection of their data as they were aware that the controller collected personal data such as their telephone number from the AMS. The data subject only wanted to enforce their right to erasure. The data subject explained that they had suspended all of their job advertisements via the AMS’s online portal, because they no longer needed support from the AMS. However, the data subject still received text messages from the controller with job offers despite several requests for erasure. The DPA held that the controller is required to not only justify the lawfulness of its data processing under Article 6 GDPR, but also to comply with the principles of processing under Article 5 GDPR. Under Article 5(2) GDPR, the controller is not only obligated to comply with these principles, but must also be a