GDPR and AI hiring

Why this is the urgent one

The EU AI Act's high-risk obligations for hiring have been deferred to December 2027. That deferral has produced a lot of relieved planning, and it is mostly misplaced — because the GDPR was never waiting for anything.

AI Act Art 2(7) is explicit that the AI Act "shall not affect Regulation (EU) 2016/679." The two regimes are cumulative. And on the specific question of whether you may let a model decide who gets rejected, the GDPR is both older and sharper.

Article 22

"The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her."

Rejecting a job application "similarly significantly affects" the applicant. That is not a contested reading. So automated candidate screening sits inside Art 22(1) unless one of three exceptions in Art 22(2) applies: necessity for a contract, authorisation by Union or Member State law, or explicit consent.

Where you rely on contract necessity or explicit consent, Art 22(3) requires safeguards — at minimum the right to obtain human intervention, to express one's point of view, and to contest the decision. And Art 22(4) bars such decisions from being based on Art 9(1) special category data unless Art 9(2)(a) or (g) applies with suitable safeguards.

SCHUFA: the score is the decision

CJEU, C-634/21 SCHUFA Holding (Scoring), 7 December 2023, is the case that reframed this whole area — and most hiring-AI marketing hasn't caught up with it.

The Court held that a credit agency's automated production of a probability value is itself automated individual decision-making under Art 22(1) — where a third party to which that value is transmitted draws strongly on it to establish, implement or terminate a contractual relationship.

What "solely" really means

The obvious escape from Art 22 is to put a human in the loop, so the decision isn't solely automated. This works — but only if the human is real.

A reviewer who clicks approve on a ranked list has not made the decision; the model did, and they witnessed it. Defeating "solely" requires meaningful human involvement: someone with the authority to reach a different conclusion, and — the part usually missing — the information to do so. You cannot meaningfully review a decision whose reasoning you cannot see.

Legal basis in recruitment

Every processing operation needs an Art 6 basis. In recruitment the choice is narrower than it looks.

Consent is the weakest option, not the safest

The instinct is to ask the candidate to tick a box. Recital 43 is the problem: consent should not provide a valid legal ground "where there is a clear imbalance between the data subject and the controller." An applicant who believes refusing will cost them the job is not consenting freely. Building the candidate flow on consent and assuming it holds is the single most common structural error in this space.

Article 6(1)(b) — contract necessity

"processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract"

The second limb — pre-contractual steps at the data subject's request — is the natural fit: the candidate applied, and assessment is a step toward the employment contract. Recital 44 supports it: "Processing should be lawful where it is necessary in the context of a contract or the intention to enter into a contract."

But necessary is read narrowly. It covers what the process genuinely requires — not everything a recruiter would find interesting. Passive capture of timing, device or screen activity is where this basis usually starts to strain.

Article 6(1)(f) — legitimate interests

Available, but it is not a free pass: it requires a documented balancing test weighing your interest against the candidate's rights and reasonable expectations. Keep the assessment. You may have to produce it, and producing it late looks like writing it late.

The right to an explanation

Arts 13(2)(f), 14(2)(g) and 15(1)(h) require, where Art 22 automated decision-making exists, "meaningful information about the logic involved" plus the significance and envisaged consequences.

CJEU, C-203/22 Dun & Bradstreet Austria, 27 February 2025, said what that actually means — and it is more demanding than most vendors have priced in:

• You must explain the procedure and principles actually applied, such that the data subject can exercise their Art 22(3) rights.
• A complex mathematical formula does not suffice.
• Neither does a step-by-step description of the algorithm.
• Trade secrecy is not a blanket exclusion. A national law cannot categorically exempt disclosure; the controller may have to disclose to the competent authority or court for a case-by-case balancing.

The bias-testing paradox

Here is a genuine contradiction at the heart of fair AI hiring, and it deserves to be stated rather than glossed.

To prove your system doesn't discriminate on race or ethnicity, you need data about race and ethnicity. That is Art 9(1) special category data, whose processing is prohibited absent an Art 9(2) condition. Testing for bias requires collecting exactly what you are told to minimise. And in the US, 29 CFR 1607.4(A) affirmatively requires you to hold records of impact by race, sex and ethnic group.

The AI Act's answer is Art 10(5), permitting special-category processing where strictly necessary for bias detection and correction. But it is a narrow gate with six cumulative conditions — no other data (including synthetic or anonymised) would work; state-of-the-art security and pseudonymisation; strict documented access control; no transmission to or access by other parties; deletion once corrected; and records justifying the necessity. Miss one and the derogation doesn't apply.

DPIAs

Art 35 requires a data protection impact assessment where processing is likely to result in a high risk — and expressly names systematic and extensive evaluation based on automated processing, including profiling, on which decisions producing legal or similarly significant effects are based. AI-assisted candidate screening is close to the paradigm case.

AI Act Art 26(9) connects the two: deployers must use the provider's Art 13 information to perform their Art 35 DPIA. Which is worth noting for a private employer, since — as the AI Act guide explains — you probably do not owe a Fundamental Rights Impact Assessment. The DPIA is your real obligation, and it exists today.

Retention

How long may you keep a rejected candidate's data? There is no single answer, and the honest version has three parts.

• Art 5(1)(e) storage limitation pushes down.
• Art 17(3)(e) — not Art 5(1)(e)'s archiving proviso — is the correct basis for keeping data to defend a claim: the erasure right does not apply where processing is necessary "for the establishment, exercise or defence of legal claims."
• The actual period is derived from your jurisdiction's limitation periods, and they conflict — roughly 6 months in Germany, an obligatory 5 years in France, 1 year plus an open-ended litigation hold in the US.

The full comparison, and how CNIL's active/archive tiering resolves the conflict, is here.

Controller or processor?

When you use HireBeep, you are the controller of your candidates' data: you decide the purpose and the means. We act as a processor on your documented instructions, under an Art 28 data processing agreement.

That allocation is not determined by what a contract calls it. Roles follow who actually decides purposes and means — so a vendor exercising real decision-making over how candidates are scored, or using candidate data for its own purposes, may be a joint controller under Art 26 whatever the paperwork says. It is a fair question to put to any vendor in this category, including us. Our answer.

Where HireBeep fits

Read back over this page and a pattern emerges: nearly every GDPR obligation on AI hiring reduces to being able to say what happened and why, to a candidate or to an authority, months later.

• A written rationale for every grade — so Art 15(1)(h) has an answer that isn't a formula, and human review has something to review.
• Human oversight that can actually overturn — so "not solely automated" is true rather than asserted.
• Full audit trail — so Art 5(2) accountability is a query, not an archaeology project.
• Structured, consistent assessment — so the DPIA describes a process you can characterise, rather than a black box you're hoping about.