DPA case PS/00009/2026 – Violation Found (Spain, 2026)

Αn enterprise (the controller) planned the implementation of an AI tool intended to be used for the screening and evaluation of candidates in recruitment and internal mobility processes. The system will seek to analyse resumes, assign scores and prioritise candidates which may have a direct influence on the decisions regarding employment and promotions. Clarified was that final decisions were to be made by a human. The controller notified its employees of the implementation of this system in December. The DPA started an investigation. The controller clarified that it is part of a group of undertakings which is carrying out the evaluation and development of the system including compliance with data protection at a central level. Regardless, the controller emphasised it would analyse the established data protection implications and take appropriate measures prior to putting the system into operation. Following the investigation, the DPA issued a warning to the controller. The DPA addressed the controller’s obligation to ensure data protection by design and default and to implement appropriate technical and organisational measures to ensure data protection compliant processing in accordance with Articles 24 and 25 GDPR. More specifically, the DPA addressed the necessity for a risk assessment posed by the system, and if the processing is likely to result in a high-risk, to also implement the necessary DPIA pursuant to Article 35 GDPR. Furthermore, the DPA warned of the principle of transparency in relation to data subjects and their rights. That means providing them clear, accessible and understandable information regarding their personal data and the way it is processed. In this regard the controller is to take into account the functioning off the tool, and degree of human intervention throughout the process. Particularly, the controller must assess the possibility of Article 22 GDPR application and corresponding necessary limitations and safeguards.