AEPD (Spain) - PS/00009/2026
Spain's AEPD issues a warning over an AI tool used for hiring and promotions.
Spain's Data Protection Agency (AEPD) has issued a warning to a company regarding its implementation of an AI tool for screening and evaluating job candidates and internal mobility processes. The AI system analyzes resumes, assigns scores, and prioritizes candidates, potentially influencing employment and promotion decisions. The AEPD emphasized the controller's obligations for data protection by design and default, the need for risk assessments and Data Protection Impact Assessments (DPIAs) if high risks are identified, and the importance of transparency with data subjects regarding the tool's functioning and human intervention.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Spanish company deployed an AI-based candidate screening tool without fulfilling key GDPR obligations, including Data Protection Impact Assessments (DPIAs) and adequate transparency measures for affected individuals. The AI system assigned scores and influenced employment decisions — a high-risk processing activity under GDPR Article 35 — without proper safeguards or human oversight mechanisms. This matters because automated decision-making in employment contexts can perpetuate bias, violate individuals' rights, and expose organizations to significant regulatory penalties. Deploying AI tools that affect people's livelihoods without rigorous data protection governance is both an ethical and legal failure.
What helps against this
How we list vendors- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.