AEPD (Spain) - PS/00009/2026
Spain's AEPD warns company over AI tool for hiring and promotions.
Summary
Spain's Data Protection Agency (AEPD) has issued a warning to a company regarding its planned implementation of an AI tool for screening and evaluating job candidates. The agency emphasized the company's obligation to conduct a proper risk assessment, implement data protection by design and default, and potentially perform a Data Protection Impact Assessment (DPIA) if the processing is high-risk. Transparency with employees about the tool's functioning and human intervention was also highlighted.
The lesson from this incident
Full lessonSpain's AEPD flagged a company for planning to deploy an AI-based candidate screening tool without fulfilling mandatory GDPR obligations, including Data Protection Impact Assessments (DPIAs) and data protection by design principles. AI systems used in employment decisions can significantly affect individuals' rights, making them high-risk processing activities under GDPR Article 22. The absence of proper risk assessment before deployment—rather than after—is a critical failure, as remediation post-launch is far more costly and disruptive. Transparency obligations were also overlooked, meaning candidates and employees had no visibility into how automated decisions were being made or whether human oversight existed.
What helps against this
How we list vendors- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.