Quick Hits
- Spain’s data protection authority, the AEPD, issued a formal warning to a company before its AI recruitment tool was switched on.
- EU regulators demonstrate willingness to invoke their GDPR powers and intervene at the AI procurement stage.
- The EU AI Act lists as high-risk, under Annex III, certain types of AI recruitment tools including those that screen or filter applications, and evaluate candidates throughout the recruitment process.
- High-risk recruitment AI tools trigger human oversight and transparency obligations.
- Noncompliance with the GDPR can attract fines of up to €20 million or 4 percent of global annual turnover for employers.
- Noncompliance with the EU AI Act can attract fines of up to €35 million or 7 percent of global annual turnover for employers.
The AEPD recently issued a formal preventive warning to an organisation that was preparing to deploy an AI recruitment tool that would screen and evaluate job applications, and existing employee applications for internal mobility.
The AEPD acknowledged that AI can improve the efficiency and quality of hiring processes, although it stressed that data protection safeguards must be embedded from the very outset, reflecting the GDPR principle “data protection by design and by default.”
The AEPD highlighted several specific legal requirements when it comes to deploying an AI recruitment tool. Organisations must undertake a Data Protection Impact Assessment (DPIA) before the tool is used, where the processing is likely to result in a “high risk” to individuals’ rights and freedoms. Candidates and employees must receive clear and comprehensible information about how their personal data will be processed and the role the AI tool will play in evaluating them. Human oversight of outcomes is required by both the GDPR and the EU AI Act. This must be “effective,” meaning the decision-maker must be able to critically assess the score or output generated by the system and reach their own independent conclusion, rather than simply rubber-stamping the AI’s recommendation.
Practical Considerations
For employers wishing to deploy AI recruitment tools that will be used to rank and filter applications, the first step is to determine if the tool will be assisting recruitment decisions or influencing or determining decisions.
The GDPR (Article 22) gives individuals the right not to be subjected to decisions made solely through automated processing that would have a legal or similarly significant effect on them. The AEPD warning showcases how the functioning of an AI recruitment tool, and the level of human-intervention in the process outcomes, will be central to whether or not Article 22 applies.
If the tool will be influencing decisions, employers will need to undertake a DPIA, implement appropriate safeguards, notify individuals that automated decision-making is in use, update privacy notices describing the role of AI in the recruitment process, and ensure there is human-oversight and documentation relating to this particular safeguard.
Additionally, the EU AI Act Annex III lists as high-risk, AI recruitment tools that screen and filter candidates—this is the case even if the tool does not make the final recruitment decision. This classification means that employers will need to take compliance steps including:
- where applicable, performing a fundamental rights impact assessment;
- establishing a protocol for human oversight which would include the ability for someone to analyse, challenge, and override outcomes, maintain an in-depth understanding of how the AI works (e.g., how it is trained, tested, guardrails in place to minimise risk of bias, can verify and explain outcomes, has in place strong audit controls);
- documenting how the recruitment process relies on AI outcomes;
- providing training to their recruitment team; and
- updating privacy notices to inform individuals that they will be subject to automated decision-making.
Regulatory Action in the EU and the Impact on U.S. Employers
As governments and tech leaders discuss the regulation of AI the AEPD warning illustrates how EU regulators have already acted and are moving earlier and more assertively to enforce data protection and AI governance requirements around automated hiring technology, even before a tool goes live.
The AI recruitment tool in question is the type of cost-saving, efficiency tool that many employers are exploring and deploying. These tools will rapidly scan through applications, assign scores, and prioritise candidates. This strategically significant tech, with sizeable upfront costs, aims to reduce costly recruitment processes by speeding up the labor-intensive steps associated with resume review, and identify the best talent.
For U.S. employers that recruit candidates located in Europe, this is a reminder to build privacy and AI compliance into the recruitment tool procurement process before new recruitment tools are deployed. If the new recruitment tool is screening and filtering applications and candidates, then it is likely high-risk AI under the EU AI Act. If the new recruitment tool is capable of making decisions, rather than simply assisting the employer, it likely meets the automated decision-making threshold of the GDPR. Both legal frameworks impose strict requirements that must be complied with.
Ogletree Deakins’ Artificial Intelligence and Innovation Practice Group, Cybersecurity and Privacy Practice Group, and will continue to monitor developments and provide updates on the Artificial Intelligence and Innovation, Cross-Border, Cybersecurity and Privacy, and Workforce Analytics and Compliance Practice Group blogs as additional information becomes available.
Simon J. McMenemy is the managing partner of Ogletree Deakins’ London office and co-chair of the firm’s Cybersecurity and Privacy Practice Group.
Nicola McCrudden is of counsel in the London office of Ogletree Deakins.
Lorraine Matthews, a paralegal in the London office of Ogletree Deakins, contributed to this article.
Follow and Subscribe
LinkedIn | Instagram | Webinars | Podcasts
