EDPB puts ADMT-based recruitment in focus under Coordinated Enforcement Framework

The European Data Protection Board announced its 2027 coordinated enforcement action will focus on data protection implications of automated decision-making technology in the employment context. The sixth action under the the board's Coordinated Enforcement Framework calls on EDPB members and the European Data Protection Supervisor to voluntarily conduct compliance reviews for EU General Data Protection Regulation provisions on "the right not to be subject to decisions based solely on automated processing" and the right of access around ADMT-driven candidate screening tools.

The 2027 action is specifically examining compliance with Article 22 of the GDPR, which provides data subjects the right to refuse automated decisions, including those that support profiling practices, in instances where the decision "produces legal effects concerning him or her or similarly significantly affects him or her." Article 22 does not apply in cases where explicit consent was provided; the decision is required to fulfill a contract between a data subject and data processor; or the use of ADMT is required under law and carries suitable measures to safeguard the data subject's rights and freedoms and legitimate interests.

The EDPB has tackled the intersection of AI and data protection many times in recent years as governance concerns have grown, but the board has not explicitly done anything related to ADMT since 2018. As the Article 29 Working Party, the group published detailed guidance in May 2018 detailing the application of Article 22 and how other GDPR provisions cover ADMT and profiling.

The CEF will help generate more references for approaching ADMT enforcement and compliance. Launched initially within the EDPB 2021-23 strategy, the framework aims to foster "a structure for DPAs to work together, coordinate or facilitate enforcement actions on a pre-defined topic and with an agreed-upon methodology."

The most recent CEF actions included GDPR compliance reviews on provisions covering transparency and information obligations as well as how controllers handle the rights to erasure and access. The final report on this year's transparency action is not expected until early 2027.

IAPP Managing Director, Europe, Isabelle Roccia, CIPP/E, previously examined the CEF process, including specific activities EDPB members undertake during an action and what to expect around potential outcomes of their compliance reviews.