DPA case 37/2026 – Complaint Upheld (Belgium, 2026)

A job candidate (the data subject) took part in an interview via videoconference with the employee of a company (the controller). The employee conducting the interview recorded the last part of the interview in order to review it later on. At a later date the controller informed the data subject that they did not receive the job. He, in turn, asked to view the video recording of his interview. The data subject repeated his request several times. However, the controller informed him that the recording was deleted. The data subject filed a complaint with the Belgian DPA (APD) regarding his right under Article 15 GDPR arguing that the controller deleted the video recording after his second request for access. The controller claimed that the retention period for the video recording had to be very short due to the purpose of processing the data subject’s personal data (i.e. the possibility for the interview to review the interview after having to leave the interview early). Furthermore, the controller argued that anonymising the video would have constituted a disproportionate effort, and, that providing a copy of the recording would have violated its business confidentiality. The DPA accepted the controller’s claim that the retention period for the video recording should have been limited in this particular case. However, the DPA also noted that the recording should have been retained for at least the period required to process the data subject’s request after receiving the first access request. Therefore, at a prima facie analysis, the DPA found that the controller may have failed to comply with Article 12(2) GDPR, Article 12(4) GDPR, and Article 15 GDPR. Therefore, it issued a warning to the controller to ensure future compliance with the above-mentioned articles.