[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSo-mF8he-iGYMXHXYQqf5Hvc2SseVeV9VjAoJQbZ8xo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":33,"created_at":34,"published_at":35,"article":36,"tags":40,"podcasts":53,"controls":54},"b2c37c7d-dde8-4d7b-99f8-ac48d53134d2","ai-hiring-tool-triggers-gdpr-warning-over-lack-of-dpias-and-transparency","9881253e-d2e2-46c6-846c-75a7d1007ae0","AI Hiring Tool Triggers GDPR Warning Over Lack of DPIAs and Transparency","A Spanish company deployed an AI-based candidate screening tool without fulfilling key GDPR obligations, including Data Protection Impact Assessments (DPIAs) and adequate transparency measures for affected individuals. The AI system assigned scores and influenced employment decisions — a high-risk processing activity under GDPR Article 35 — without proper safeguards or human oversight mechanisms. This matters because automated decision-making in employment contexts can perpetuate bias, violate individuals' rights, and expose organizations to significant regulatory penalties. Deploying AI tools that affect people's livelihoods without rigorous data protection governance is both an ethical and legal failure.","**Immediate actions:**\n- Conduct a Data Protection Impact Assessment (DPIA) before deploying or continuing to operate any AI tool that influences employment decisions.\n- Provide clear, accessible transparency notices to candidates and employees explaining how the AI system works, what data it uses, and what human oversight exists.\n\n**Governance & compliance measures:**\n- Establish an internal AI governance policy that mandates privacy-by-design and privacy-by-default reviews for all AI procurement or development.\n- Appoint a Data Protection Officer (DPO) or equivalent role to review automated decision-making tools for GDPR Article 22 compliance before go-live.\n- Maintain documented records of processing activities (RoPA) for all AI systems, including the logic, data inputs, and risk mitigations applied.\n\n**Long-term improvements:**\n- Implement a recurring audit schedule to reassess AI tools for evolving regulatory requirements, bias risks, and data minimization compliance.\n- Establish a meaningful human review process for all AI-influenced employment decisions to ensure individuals can contest automated outcomes.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5 (Data Protection Principles)","GDPR Article 13\u002F14 (Transparency & Information Obligations)","GDPR Article 22 (Automated Individual Decision-Making)","GDPR Article 25 (Data Protection by Design and by Default)","GDPR Article 35 (Data Protection Impact Assessment)","NIST AI RMF (AI Risk Management Framework) - GOVERN, MAP, MEASURE","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","CIS Control 18 (Penetration Testing \u002F Application Software Security)","ISO\u002FIEC 27001 Annex A.5.34 (Privacy and Protection of PII)","EU AI Act Article 9 (Risk Management for High-Risk AI Systems)",{"GDPR Article 5 (Data Protection Principles)":23,"GDPR Article 35 (Data Protection Impact Assessment)":24,"GDPR Article 22 (Automated Individual Decision-Making)":25,"GDPR Article 25 (Data Protection by Design and by Default)":26,"ISO\u002FIEC 27001 Annex A.5.34 (Privacy and Protection of PII)":27,"GDPR Article 13\u002F14 (Transparency & Information Obligations)":28,"EU AI Act Article 9 (Risk Management for High-Risk AI Systems)":29,"NIST AI RMF (AI Risk Management Framework) - GOVERN, MAP, MEASURE":30,"CIS Control 18 (Penetration Testing \u002F Application Software Security)":31,"NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)":32},"The core principles of fairness, transparency and purpose limitation were at stake when candidates were scored by AI without being told.","A DPIA was required before AI screening of candidates, a high-risk activity, and its absence was central to this enforcement case.","Article 22 restricts decisions based solely on automated processing, so AI scores influencing hiring needed human review and safeguards.","Data protection by design would have built transparency and human oversight into the hiring tool before it was used on candidates.","Protecting PII requires controls over how candidate data is used in AI scoring, including documented purposes and safeguards.","Transparency obligations require telling candidates that an AI tool screens and scores them and how it works, which the company failed to do.","AI used for recruitment is high-risk under the AI Act, requiring a documented risk management system like the one missing here.","The AI RMF's govern, map and measure functions call for identifying bias and impact risks in an AI hiring tool before deployment.","Application security testing, applied to an AI hiring tool, helps assess how it processes candidate data before it influences decisions.","Establishing a lawful basis and authority for processing candidate data through AI is a precondition that was not properly addressed.","published","2026-10-08T16:21:43.420314+00:00","2026-10-08T16:21:43.317+00:00",{"id":7,"url":37,"slug":38,"title":39},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00009\u002F2026&diff=53351&oldid=0","aepd-spain-ps-00009-2026-d1bad4","AEPD (Spain) - PS\u002F00009\u002F2026",[41,47],{"id":42,"name":43,"slug":44,"description":45,"color":46},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":48,"name":49,"slug":50,"description":51,"color":52},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[55,59],{"slug":56,"name":57,"problem":58},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",{"slug":60,"name":61,"problem":62},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]