DSB (Austria) - 2024-0.835.856

}}}} The DPA held that a company could retain and process a job applicant’s personal data even after rejection, as doing so served its legitimate interest in defending itself against possible legal claims raised by the applicant.The DPA held that an organisation could retain and process a job applicant’s personal data even after rejection, as doing so served its legitimate interest in defending itself against possible legal claims raised by the applicant. == English Summary ==== English Summary == === Facts ====== Facts === A data subject applied for the position of IT system administrator to a company (the controller) on 13 January 2024. They submitted all the requested in the job posting relevant application materials, namely cover letter, resume and references. The data subject together with their application also submitted an attachment titled “IMPORTANT – Please read!”. In this, the data subject set out their position on the permitted use, storage and retention of their personal d