Automated CV screening tools are becoming standard in recruitment. But they raise questions about GDPR compliance—especially Article 22, which restricts fully automated decision-making. Agency owners and ops directors need to understand what this means for their AI-powered CV systems and how to manage the risks.
What Article 22 actually prohibits
Article 22 of the GDPR limits decisions made solely by automated processes when those decisions produce legal effects or similarly significant impacts on individuals. For recruitment, this means you can't reject or shortlist candidates based purely on automated CV screening without human involvement.
The key points are:
- The decision must be "solely" automated. Any meaningful human input typically removes the Article 22 restriction.
- The decision must have legal or similarly significant effects. Routine CV parsing or ranking that doesn't determine final outcomes mightn't trigger Article 22.
- Examples of significant effects include immediate rejection with no human review or automated exclusion from interview pools.
Article 22 aims to protect candidates from unfair or opaque automated decisions. If your AI tool automatically rejects candidates without human oversight, you likely trigger Article 22.
The three exemptions (and how to qualify for them)
Article 22 allows exceptions. Automated decisions can proceed without human involvement if one of these applies:
- Explicit consent: The candidate has given clear, informed consent to automated decisions. In recruitment, this is rare and tricky to prove.
- Contract necessity: The automated decision is necessary to enter or perform a contract. For example, automated background checks linked to contract terms might qualify.
- Authorised by law: A legal requirement or public interest permits automated decisions. This rarely applies in private recruitment.
Agencies relying on these exemptions should document the legal basis clearly and ensure transparency with candidates. Consent must be explicit and revocable, and contract necessity must be demonstrably essential to the recruitment process.
Does your CV tool trigger Article 22?
Most CV parsing and formatting tools don't trigger Article 22 because they don't make decisions—they merely organise data.
Distill, for example, reformats CVs by stripping personal identifiers and standardising layout before submission. It doesn't reject, shortlist, or rank candidates automatically. Therefore, Distill doesn't trigger Article 22.
If your CV tool includes AI-driven scoring or ranking that directly affects hiring decisions without human review, it may trigger Article 22.
Ask:
- Does the tool make final decisions or recommendations without human involvement?
- Are candidates rejected or shortlisted solely by the system?
- Is there a meaningful human review step after the automated process?
If the answer to these is no, Article 22 likely doesn't apply to your tool.
Human-in-the-loop requirements in practice
To comply with Article 22, many agencies implement a "human-in-the-loop" approach. This means:
- Automated CV screening suggests or ranks candidates.
- A human recruiter reviews these outputs and makes final decisions.
- The human can override or disregard the automated results.
This approach typically avoids Article 22 restrictions because the decision isn't "solely" automated.
Best practice includes:
- Documenting the human review process.
- Ensuring reviewers have enough information to assess candidates fairly.
- Training staff on the limits of automated tools.
- Keeping records of decisions and human involvement.
This balances efficiency with compliance risk.
Data subject rights under Article 22
Candidates have rights connected to automated decision-making:
- Right to information: They must be told if automated decision-making is used, its logic, and consequences.
- Right to human intervention: Candidates can request human review of automated decisions.
- Right to contest: They can challenge decisions made solely by automated means.
Recruitment agencies should update privacy notices and candidate communications accordingly. Transparency is key.
Also, these rights interact with other GDPR rights such as access, rectification, and erasure. See UK GDPR right to erasure for recruitment for more.
EU vs UK-GDPR: differences post-Brexit
Post-Brexit, the UK retained GDPR principles in its UK-GDPR, closely mirroring the EU GDPR, including Article 22.
Differences are subtle but relevant:
- The UK Information Commissioner's Office (ICO) enforces UK-GDPR, while EU Data Protection Authorities enforce EU GDPR.
- The UK may diverge over time, but currently, Article 22 obligations are effectively the same.
- Cross-border data transfers between the UK and EU remain subject to adequacy decisions or standard contractual clauses.
Agencies operating in both jurisdictions should align policies with the stricter standard and monitor regulatory updates.
FAQ
Q: Can I use AI CV screening tools if I have human oversight? Yes. If a human makes the final hiring decision and can override the AI, Article 22 typically doesn't apply.
Q: What counts as "meaningful human involvement"? It must be more than a quick glance. The human should understand the automated process and have the power to change or disregard its output.
Q: Does anonymising CVs avoid Article 22? No. Anonymising data reduces bias but doesn't exempt automated decisions from Article 22 if they have legal or significant effects.
Q: What if I use automated CV ranking to shortlist candidates for interview? If no final decision is made solely by automation, and humans review the shortlist, Article 22 usually doesn't apply.
Q: How do I inform candidates about automated decisions? Include clear statements in privacy notices and candidate communications explaining the use of AI tools, the logic involved, and rights under Article 22.
If you're sending 20+ CVs a week to clients using automated screening, you need to ensure your tools don't trigger Article 22. Distill reformats CVs without making decisions, helping you avoid automated decision risks while improving compliance and efficiency. Try Distill free to see how it supports your GDPR obligations.