Austrian Agency Fined €25,500 for Unlawful Recording of Job Applicant Interviews
Written by AI from the linked story. Not reviewed by an editor. How this works
A digital marketing agency in Austria was fined €25,500 after it recorded job applicant phone interviews without a valid legal basis, indefinitely stored those recordings, and failed to inform applicants about the recordings or identify the data controller. The Austrian DPA found no valid consent was obtained and that legitimate interest could not justify the processing, in line with the CJEU's ruling in Case C-807/21. This case illustrates that even routine HR processes can constitute serious GDPR violations when organisations fail to establish a lawful basis for processing personal data. It also underscores the obligation under GDPR Articles 13 and 14 to proactively inform data subjects about how their data is being collected and used. Organisations that treat compliance as an afterthought in operational workflows — rather than embedding it into process design — expose themselves to significant regulatory and reputational risk.
Tactical Insight
Immediate actions
- Audit all HR and recruitment processes to identify any recording or data collection activities that lack a documented lawful basis under GDPR Article 6.
- Implement mandatory privacy notices for all candidate touchpoints (phone, video, email) that clearly identify the controller and explain data use before any interview begins.
- Cease indefinite retention of personal data recordings and establish defined, documented retention periods aligned with business necessity.
Long-term improvements
- Embed Privacy by Design principles into all HR workflows so that data collection activities require sign-off from a Data Protection Officer or privacy lead before deployment.
- Conduct annual GDPR training for HR and recruitment staff, focusing on lawful bases for processing, data subject rights, and transparency obligations.
- Develop and maintain a Records of Processing Activities (RoPA) register that captures every category of personal data processed during recruitment, including the legal basis for each.
Detection & governance measures
- Schedule regular internal audits of data processing activities against the RoPA to detect unauthorised or undocumented processing before a regulatory complaint is filed.
- Establish a data subject request and complaints intake process so applicants can easily raise concerns, enabling early identification of compliance gaps.
- Appoint or designate a Data Protection Officer (or equivalent privacy lead) with authority to review and halt non-compliant data collection practices.