[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDWnmF5a2YXDJqYcZRrEpJRns2vjOkEFugg3YuMM1K5Q":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"fc14b5d0-064d-4624-81a0-9f2703d1d1d1","DSB (Austria) - 2025-1.049.138","dsb-austria-2025-1-049-138-23b85b","Fixed link ← Older revision Revision as of 08:02, 8 October 2026 Line 99: Line 99: |Appeal_To_Body=Bundesverwaltungsgericht (Austria) |Appeal_To_Body=BVwG (Austria) |Appeal_To_Case_Number_Name= |Appeal_To_Case_Number_Name= |Appeal_To_Status=Pending appeal |Appeal_To_Status=Pending appeal","The Austrian Data Protection Authority (DSB) has fined a digital marketing agency €25,500 for recording and indefinitely storing phone interviews with job applicants without a valid legal basis. The agency also failed to inform applicants about the recordings or the identity of the controller. The DPA found that the recordings lacked proper consent and were not justified by legitimate interests, citing the CJEU's ruling in Case C-807\u002F21.","Austrian DPA fines digital marketing agency €25,500 for unlawful recording of applicant interviews.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_2025-1.049.138&diff=53334&oldid=52606","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F1\u002F1f\u002FLogoAT.png","2026-10-08T08:02:08+00:00","2026-10-08T10:00:15.999949+00:00",7,[17,20],{"name":18,"type":19},"DSB","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,38,40],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":21,"slug":37},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":67},"austrian-agency-fined-25500-for-unlawful-recording-of-job-applicant-interviews","Austrian Agency Fined €25,500 for Unlawful Recording of Job Applicant Interviews","A digital marketing agency in Austria was fined €25,500 after it recorded job applicant phone interviews without a valid legal basis, indefinitely stored those recordings, and failed to inform applicants about the recordings or identify the data controller. The Austrian DPA found no valid consent was obtained and that legitimate interest could not justify the processing, in line with the CJEU's ruling in Case C-807\u002F21. This case illustrates that even routine HR processes can constitute serious GDPR violations when organisations fail to establish a lawful basis for processing personal data. It also underscores the obligation under GDPR Articles 13 and 14 to proactively inform data subjects about how their data is being collected and used. Organisations that treat compliance as an afterthought in operational workflows — rather than embedding it into process design — expose themselves to significant regulatory and reputational risk.",[55,56,57,58,59,60,61,62,63,64,65,66],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 5(1)(e) – Storage limitation","GDPR Article 6 – Lawfulness of processing","GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 14 – Information to be provided where personal data have not been obtained from the data subject","GDPR Article 30 – Records of processing activities (RoPA)","CJEU Case C-807\u002F21 – Legitimate interest balancing test","NIST Privacy Framework PR.PO-P1 – Policies, processes, and procedures for managing data","NIST SP 800-53 IP-1 – Consent","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management System (PIMS)","ITIL Service Design – Privacy and data compliance in process design",{}]