Privacy / AI Governance / Regulation
EDPB picks automated decision-making in recruitment as 2027 coordinated enforcement topic
Participating data protection authorities will review compliance with GDPR Article 22 and the right of access where automated tools screen job candidates.
The European Data Protection Board has chosen automated decision-making in the employment context, specifically candidate screening in recruitment, as the topic of its 2027 coordinated enforcement action, according to IAPP. IAPP describes it as the sixth action under the Coordinated Enforcement Framework (CEF). Reviews will cover GDPR Article 22, the right not to be subject to decisions based solely on automated processing, and the right of access.
Under the EDPB’s framework, participation by authorities is voluntary. Each authority may run fact-finding exercises, open new formal investigations or follow up on existing ones. A shared questionnaire or audit guide is drawn up, authorities launch at the same time, and national reports are combined into an EDPB report with findings and recommendations.
According to IAPP, the board has not explicitly done anything related to automated decision-making since 2018; as the Article 29 Working Party, it published detailed guidance on applying Article 22 in May 2018.
Why it matters
Employers and HR technology vendors using automated CV screening or candidate ranking should expect questionnaires or investigations from authorities that opt in during 2027. Teams should map where recruitment decisions are made solely by automated means, document which Article 22 exception they rely on, and confirm that access requests from candidates can return meaningful information about the logic and data used. Data owners for HR systems should check that candidate data inputs and model outputs are traceable enough to support such responses.
Status: Announced. Action runs in 2027; authority participation is voluntary
What to check
- Identify recruitment tools that screen or rank candidates and determine whether any decision is made solely by automated means under Article 22.
- Record the Article 22 exception relied on (explicit consent, contract necessity or legal authorisation) and the safeguards in place for each such tool.
- Test whether a candidate access request can be answered with the data and decision information produced by automated screening tools.
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Institutions
Who should care
- DPO
- HR data owners
- AI governance lead
- Legal & compliance