[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fW-rQQDAGTMDPIiEH0dZQMwDa6v0FNOLQ78dMMJ-wF48":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":76},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"dd94e292-3c68-4e4b-b864-757fba53befe","AEPD (Spain) - PS\u002F00009\u002F2026","aepd-spain-ps-00009-2026-cc7623","← Older revision Revision as of 08:53, 14 October 2026 (2 intermediate revisions by the same user not shown) Line 108: Line 108: }} }} The DPA issued a warning concerning the implementation by a controller of an AI tool intended to be used employment and promotion purposes. The DPA warned a company concerning the planned implementation of an AI tool intended to be used for hiring and promotion purposes. In particular, the DPA pointed to the controller’s obligation to perform a proper risk assessment. == English Summary == == English Summary == === Facts === === Facts === The DPA received a letter by an enterprise (the controller) who reported the implementation of an AI tool intended to be used for the screening and evaluation of candidates in recruitment and internal mobility processes. The system will seek to analyse resumes, assign scores and prioritise candidates which may have a direct influence on the decisions regarding employment and promotions. Clarified was that final decision was to be made by a human. The controller notified its employees of the implementation of this system in December. Αn enterprise (the controller) planned the implementation of an AI tool intended to be used for the screening and evaluation of candidates in recruitment and internal mobility processes. The system will seek to analyse resumes, assign scores and prioritise candidates which may have a direct influence on the decisions regarding employment and promotions. Clarified was that final decisions were to be made by a human. The controller notified its employees of the implementation of this system in December. The DPA started an investigation. The controller clarified that it is part of a group of undertakings which is carrying out the evaluation and development of the system including compliance with data protection at a central level. Regardless, the controller emphasised it would analyse the established data protection implications and take appropriate measures prior to putting the system into operation. The DPA started an investigation. The controller clarified that it is part of a group of undertakings which is carrying out the evaluation and development of the system including compliance with data protection at a central level. Regardless, the controller emphasised it would analyse the established data protection implications and take appropriate measures prior to putting the system into operation. === Holding === === Holding === Following the investigation, the DPA issued a warning to the controller. The DPA addressed the controller’s obligation to ensure data protection by design and default and to implement appropriate technical and organisational measures to ensure data protection compliant processing in accordance with Articles 24 and 25 GDPR. More specifically, the DPA addressed the necessity for a risk assessment posed by the system, and if the processing is likely to result in a high-risk, to also implement the necessary DPIA pursuant to [[Article 35 GDPR|Article 35 GDPR]]. Following the investigation, the DPA issued a warning to the controller. The DPA addressed the controller’s obligation to ensure data protection by design and default and to implement appropriate technical and organisational measures to ensure data protection compliant processing in accordance with [[Article 24 GDPR|Articles 24]] and [[Article 25 GDPR|25 GDPR.]] More specifically, the DPA addressed the necessity for a risk assessment posed by the system, and if the processing is likely to result in a high-risk, to also implement the necessary DPIA pursuant to [[Article 35 GDPR]]. Furthermore, the DPA warned of the principle of transparency in relation to data subjects and their rights. That means providing them clear, accessible and understandable information regarding their personal data and the way it is processed. In this regard the controller is to take into account the functioning off the tool, and degree of human intervention throughout the process. Particularly, the controller must assess the possibility of [[Article 22 GDPR|Article 22 GDPR]] application and corresponding necessary limitations and safeguards. Furthermore, the DPA warned of the principle of transparency in relation to data subjects and their rights. That means providing them clear, accessible and understandable information regarding their personal data and the way it is processed. In this regard the controller is to take into account the functioning off the tool, and degree of human intervention throughout the process. Particularly, the controller must assess the possibility of [[Article 22 GDPR]] application and corresponding necessary limitations and safeguards. == Comment == == Comment ==","Spain's Data Protection Agency (AEPD) has issued a warning to a company regarding its planned implementation of an AI tool for screening and evaluating job candidates. The agency emphasized the company's obligation to conduct a proper risk assessment, implement data protection by design and default, and potentially perform a Data Protection Impact Assessment (DPIA) if the processing is high-risk. Transparency with employees about the tool's functioning and human intervention was also highlighted.","Spain's AEPD warns company over AI tool for hiring and promotions.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00009\u002F2026&diff=53404&oldid=53351","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-10-14T08:53:20+00:00","2026-10-14T10:00:16.543448+00:00",7,[17],{"name":18,"type":19},"AI tool","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":42},{"id":20,"icon":22,"name":23,"slug":24},[],[],{"controls":46,"vendors":75},[47],{"slug":40,"name":48,"problem":49,"products":50},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",[],{"slug":77,"title":78,"body":79,"framework_refs":80,"framework_notes":91},"ai-hiring-tools-trigger-gdpr-scrutiny-over-missing-risk-assessments","AI Hiring Tools Trigger GDPR Scrutiny Over Missing Risk Assessments","Spain's AEPD flagged a company for planning to deploy an AI-based candidate screening tool without fulfilling mandatory GDPR obligations, including Data Protection Impact Assessments (DPIAs) and data protection by design principles. AI systems used in employment decisions can significantly affect individuals' rights, making them high-risk processing activities under GDPR Article 22. The absence of proper risk assessment before deployment—rather than after—is a critical failure, as remediation post-launch is far more costly and disruptive. Transparency obligations were also overlooked, meaning candidates and employees had no visibility into how automated decisions were being made or whether human oversight existed.",[81,82,83,84,85,86,87,88,89,90],"GDPR Article 5 (Data minimisation and purpose limitation)","GDPR Article 22 (Automated individual decision-making)","GDPR Article 25 (Data protection by design and by default)","GDPR Article 35 (Data Protection Impact Assessment)","GDPR Article 13\u002F14 (Transparency obligations)","NIST AI RMF – GOVERN 1.1 (AI risk governance policies)","NIST SP 800-53 RA-3 (Risk Assessment)","CIS Control 18 (Application Software Security)","ISO\u002FIEC 27701 – Privacy Information Management","EU AI Act Article 10 (High-risk AI system requirements)",{}]