[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSo-mF8he-iGYMXHXYQqf5Hvc2SseVeV9VjAoJQbZ8xo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42},"b2c37c7d-dde8-4d7b-99f8-ac48d53134d2","ai-hiring-tool-triggers-gdpr-warning-over-lack-of-dpias-and-transparency","9881253e-d2e2-46c6-846c-75a7d1007ae0","AI Hiring Tool Triggers GDPR Warning Over Lack of DPIAs and Transparency","A Spanish company deployed an AI-based candidate screening tool without fulfilling key GDPR obligations, including Data Protection Impact Assessments (DPIAs) and adequate transparency measures for affected individuals. The AI system assigned scores and influenced employment decisions — a high-risk processing activity under GDPR Article 35 — without proper safeguards or human oversight mechanisms. This matters because automated decision-making in employment contexts can perpetuate bias, violate individuals' rights, and expose organizations to significant regulatory penalties. Deploying AI tools that affect people's livelihoods without rigorous data protection governance is both an ethical and legal failure.","**Immediate actions:**\n- Conduct a Data Protection Impact Assessment (DPIA) before deploying or continuing to operate any AI tool that influences employment decisions.\n- Provide clear, accessible transparency notices to candidates and employees explaining how the AI system works, what data it uses, and what human oversight exists.\n\n**Governance & compliance measures:**\n- Establish an internal AI governance policy that mandates privacy-by-design and privacy-by-default reviews for all AI procurement or development.\n- Appoint a Data Protection Officer (DPO) or equivalent role to review automated decision-making tools for GDPR Article 22 compliance before go-live.\n- Maintain documented records of processing activities (RoPA) for all AI systems, including the logic, data inputs, and risk mitigations applied.\n\n**Long-term improvements:**\n- Implement a recurring audit schedule to reassess AI tools for evolving regulatory requirements, bias risks, and data minimization compliance.\n- Establish a meaningful human review process for all AI-influenced employment decisions to ensure individuals can contest automated outcomes.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5 (Data Protection Principles)","GDPR Article 13\u002F14 (Transparency & Information Obligations)","GDPR Article 22 (Automated Individual Decision-Making)","GDPR Article 25 (Data Protection by Design and by Default)","GDPR Article 35 (Data Protection Impact Assessment)","NIST AI RMF (AI Risk Management Framework) - GOVERN, MAP, MEASURE","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","CIS Control 18 (Penetration Testing \u002F Application Software Security)","ISO\u002FIEC 27001 Annex A.5.34 (Privacy and Protection of PII)","EU AI Act Article 9 (Risk Management for High-Risk AI Systems)","published","2026-10-08T16:21:43.420314+00:00","2026-10-08T16:21:43.317+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00009\u002F2026&diff=53351&oldid=0","aepd-spain-ps-00009-2026-d1bad4","AEPD (Spain) - PS\u002F00009\u002F2026",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]