[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdCYi1adTULNlPV3XnaUt9YeXHvtu-rOJHCJoR0DW5uI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"488d7290-07f3-4220-9454-2550761ee06c","austrian-agency-fined-25500-for-unlawful-recording-of-job-applicant-interviews","fc14b5d0-064d-4624-81a0-9f2703d1d1d1","Austrian Agency Fined €25,500 for Unlawful Recording of Job Applicant Interviews","A digital marketing agency in Austria was fined €25,500 after it recorded job applicant phone interviews without a valid legal basis, indefinitely stored those recordings, and failed to inform applicants about the recordings or identify the data controller. The Austrian DPA found no valid consent was obtained and that legitimate interest could not justify the processing, in line with the CJEU's ruling in Case C-807\u002F21. This case illustrates that even routine HR processes can constitute serious GDPR violations when organisations fail to establish a lawful basis for processing personal data. It also underscores the obligation under GDPR Articles 13 and 14 to proactively inform data subjects about how their data is being collected and used. Organisations that treat compliance as an afterthought in operational workflows — rather than embedding it into process design — expose themselves to significant regulatory and reputational risk.","**Immediate actions:**\n- Audit all HR and recruitment processes to identify any recording or data collection activities that lack a documented lawful basis under GDPR Article 6.\n- Implement mandatory privacy notices for all candidate touchpoints (phone, video, email) that clearly identify the controller and explain data use before any interview begins.\n- Cease indefinite retention of personal data recordings and establish defined, documented retention periods aligned with business necessity.\n\n**Long-term improvements:**\n- Embed Privacy by Design principles into all HR workflows so that data collection activities require sign-off from a Data Protection Officer or privacy lead before deployment.\n- Conduct annual GDPR training for HR and recruitment staff, focusing on lawful bases for processing, data subject rights, and transparency obligations.\n- Develop and maintain a Records of Processing Activities (RoPA) register that captures every category of personal data processed during recruitment, including the legal basis for each.\n\n**Detection & governance measures:**\n- Schedule regular internal audits of data processing activities against the RoPA to detect unauthorised or undocumented processing before a regulatory complaint is filed.\n- Establish a data subject request and complaints intake process so applicants can easily raise concerns, enabling early identification of compliance gaps.\n- Appoint or designate a Data Protection Officer (or equivalent privacy lead) with authority to review and halt non-compliant data collection practices.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 5(1)(e) – Storage limitation","GDPR Article 6 – Lawfulness of processing","GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 14 – Information to be provided where personal data have not been obtained from the data subject","GDPR Article 30 – Records of processing activities (RoPA)","CJEU Case C-807\u002F21 – Legitimate interest balancing test","NIST Privacy Framework PR.PO-P1 – Policies, processes, and procedures for managing data","NIST SP 800-53 IP-1 – Consent","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management System (PIMS)","ITIL Service Design – Privacy and data compliance in process design",{},"published","2026-10-08T10:21:43.300221+00:00","2026-10-08T10:21:43.221+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_2025-1.049.138&diff=53334&oldid=52606","dsb-austria-2025-1-049-138-23b85b","DSB (Austria) - 2025-1.049.138",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]