[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0xLrunG2klMMOazod_JLQcaGul5uaRz80JvbYWSVlAg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"ed6aed88-f8ca-4713-bd4d-c7e4f467d75d","marketing-agency-fined-25500-for-unlawful-recording-of-job-applicant-calls","4570c288-e46b-4ade-9af9-886edc51cf61","Marketing Agency Fined €25,500 for Unlawful Recording of Job Applicant Calls","A digital marketing agency recorded phone interviews with job applicants without a valid legal basis and stored those recordings indefinitely, violating core GDPR principles of lawfulness, purpose limitation, and storage limitation. Critically, applicants were never informed their calls were being recorded, nor was the identity of the data controller disclosed — breaching GDPR transparency obligations. This case highlights that personal data collected during recruitment processes carries the same legal weight as any other personal data and must be handled accordingly. Organizations that treat internal HR processes as outside the scope of data protection law expose themselves to significant regulatory and reputational risk.","**Immediate actions:**\n- Audit all current recording practices (calls, interviews, meetings) to identify any recordings lacking a valid legal basis and delete those without one.\n- Implement mandatory privacy notices for all candidate touchpoints, explicitly disclosing recording activities, the controller's identity, and the lawful basis for processing.\n\n**Policy & Governance improvements:**\n- Define and enforce a data retention schedule for recruitment data, ensuring recordings and personal data are deleted once the purpose is fulfilled.\n- Establish a lawful basis assessment process (consent, legitimate interest, etc.) that must be completed before any new data collection activity is introduced in HR workflows.\n- Assign clear data protection ownership within HR teams and require sign-off from a DPO or privacy lead for any new recruitment technology or process.\n\n**Training & Awareness measures:**\n- Deliver targeted GDPR training to HR and recruitment staff covering transparency obligations, lawful bases, and storage limitation principles.\n- Create a simple checklist for HR staff to validate GDPR compliance before launching any new candidate communication or recording process.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5(1)(a) — Lawfulness, fairness and transparency","GDPR Article 5(1)(b) — Purpose limitation","GDPR Article 5(1)(e) — Storage limitation","GDPR Article 6 — Lawfulness of processing","GDPR Article 13 — Information to be provided where personal data are collected from the data subject","GDPR Article 88 — Processing in the context of employment","NIST Privacy Framework PR.PO-P1 — Policies, processes, and procedures for managing data","NIST SP 800-53 IP-1 — Consent","CIS Control 3 — Data Protection","ISO\u002FIEC 27701 — Privacy Information Management",{},"published","2026-07-31T16:20:57.543195+00:00","2026-07-31T16:20:57.434+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_2025-1.049.138&diff=52567&oldid=0","dsb-austria-2025-1-049-138-ebbbc2","DSB (Austria) - 2025-1.049.138",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]