[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fx9i1fzatJD1bvwleCn5cNeHgtV2kf6wJO_kF7udaCPw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"1724f99f-ca32-439a-8c34-a7e25c710067","ai-hiring-tools-trigger-gdpr-scrutiny-over-missing-risk-assessments","dd94e292-3c68-4e4b-b864-757fba53befe","AI Hiring Tools Trigger GDPR Scrutiny Over Missing Risk Assessments","Spain's AEPD flagged a company for planning to deploy an AI-based candidate screening tool without fulfilling mandatory GDPR obligations, including Data Protection Impact Assessments (DPIAs) and data protection by design principles. AI systems used in employment decisions can significantly affect individuals' rights, making them high-risk processing activities under GDPR Article 22. The absence of proper risk assessment before deployment—rather than after—is a critical failure, as remediation post-launch is far more costly and disruptive. Transparency obligations were also overlooked, meaning candidates and employees had no visibility into how automated decisions were being made or whether human oversight existed.","**Immediate actions:**\n- Conduct a preliminary privacy impact screening before deploying any AI tool that processes personal data in HR workflows.\n- Engage your Data Protection Officer (DPO) or legal counsel to determine whether a full DPIA is required under GDPR Article 35.\n\n**Governance & Design measures:**\n- Embed data protection by design and by default into the AI procurement and configuration process from the outset.\n- Establish a mandatory human review mechanism for any AI-generated candidate decisions to satisfy GDPR Article 22 requirements.\n- Draft and publish a clear transparency notice explaining AI tool logic, data use, and candidates' rights to contest automated decisions.\n\n**Long-term improvements:**\n- Create an internal AI governance policy that classifies all AI use cases by risk level and maps required compliance steps for each tier.\n- Implement a recurring audit schedule to reassess AI tools for evolving regulatory requirements and bias or fairness issues.\n- Train HR and procurement teams on GDPR obligations specific to automated decision-making and employee data processing.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5 (Data minimisation and purpose limitation)","GDPR Article 22 (Automated individual decision-making)","GDPR Article 25 (Data protection by design and by default)","GDPR Article 35 (Data Protection Impact Assessment)","GDPR Article 13\u002F14 (Transparency obligations)","NIST AI RMF – GOVERN 1.1 (AI risk governance policies)","NIST SP 800-53 RA-3 (Risk Assessment)","CIS Control 18 (Application Software Security)","ISO\u002FIEC 27701 – Privacy Information Management","EU AI Act Article 10 (High-risk AI system requirements)",{},"published","2026-10-14T10:20:18.774675+00:00","2026-10-14T10:20:18.748+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS\u002F00009\u002F2026&diff=53404&oldid=53351","aepd-spain-ps-00009-2026-cc7623","AEPD (Spain) - PS\u002F00009\u002F2026",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[45],{"slug":46,"name":47,"problem":48},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught."]