- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2024-0.835.856 – Dismissed (Austria, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An application for a job was dismissed by an organization, and the applicant had specific requests about how their personal data should be used. The organization explained that it would keep the applicant's data for a limited time to defend against any legal claims. This case highlights the importance of clear communication about data handling during the hiring process.
What happened
An applicant requested that their personal data be used only for recruitment and deleted afterward.
Who was affected
The applicant who submitted a job application to the organization.
What the authority found
The authority found no violations, as the organization had a valid reason to retain the data for a limited time.
Why this matters
This case shows that organizations can retain applicant data for specific purposes, but they must clearly communicate their data handling practices. Businesses should ensure they have transparent data policies in place.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject applied for the position of IT system administrator to an organisation (the controller) on 13 January 2024. They submitted all the requested in the job posting relevant application materials, namely cover letter, resume and references. The data subject together with their application also submitted an attachment titled “IMPORTANT – Please read!”. In this, the data subject set out their position on the permitted use, storage and retention of their personal data. They stated, inter alia, that the application documents should be used solely for the recruitment process, objected to their transfer to databases or other storage systems, and requested their complete deletion upon the end of the process. The data subject also referred to possible legal actions if their personal data were not processed in accordance with their attachment declarations. The controller notified the data subject by email on 24 January 2024, that the position had been filled by another candidate. In addition, the controller responded to the data subject’s attachment. It explained that their personal data had initially been processed for the purpose of handling the application under Article 6(1)(b) GDPR. It stated that the resume would be retained for seven months in order to defend potential legal claims and then deleted. The controller further stated that it would retain the application correspondence and related documents for one year in order to demonstrate compliance with its erasure obligations and defend against potential data protection claims. It further stated that it would retain the same data for up to three years insofar as necessary to defend against the legal claims referred in the data subject’s attachment, in accordance with its legitimate interest under Article 6(1)(f) GDPR. For the response to the data subject’s correspondence, the controller had been instructed by its external data protection officer and legal counsel. The data subject lodged a complaint with th
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2024-0.835.856 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2024-0.835.856 - Austria (2025). Retrieved from cookiefines.eu
Last updated: