DSB (Austria) - 2025-1.049.138
Austrian DPA fines digital marketing agency €25,500 for unlawful recording of applicant interviews.
The Austrian Data Protection Authority (DSB) has fined a digital marketing agency €25,500 for recording and indefinitely storing phone interviews with job applicants without a valid legal basis. The agency also failed to inform applicants about the recordings or the identity of the controller. The DPA found that the recordings lacked proper consent and were not justified by legitimate interests, citing the CJEU's ruling in Case C-807/21.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DSB?
Get an email when a new story names DSB, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA digital marketing agency in Austria was fined €25,500 after it recorded job applicant phone interviews without a valid legal basis, indefinitely stored those recordings, and failed to inform applicants about the recordings or identify the data controller. The Austrian DPA found no valid consent was obtained and that legitimate interest could not justify the processing, in line with the CJEU's ruling in Case C-807/21. This case illustrates that even routine HR processes can constitute serious GDPR violations when organisations fail to establish a lawful basis for processing personal data. It also underscores the obligation under GDPR Articles 13 and 14 to proactively inform data subjects about how their data is being collected and used. Organisations that treat compliance as an afterthought in operational workflows — rather than embedding it into process design — expose themselves to significant regulatory and reputational risk.