AI-powered employment practices: PI's response to the ICO's draft recruitment and selection guidance

The volume of data collected and the methods to automate recruitment with AI poses challenges for the privacy and data protection rights of candidates going through the recruitment process.

Recruitment is a complex and multi-layered process, and so is the AI technology intended to service this process at one or all stages of it. For instance, an AI-powered CV-screening tool using natural language processing (NLP) methods might collect keyword data on candidates, while an AI-powered video interview platform might collect facial or voice pattern data on candidates. Further, this data might be repurposed into training data to improve the model, leaving candidates unsure about where their personal data ends up long after they've completed recruitment.

A move toward data-driven recruitment also risks violations of UK GDPR Article 22, which prohibits individuals from being subjected to automated decision-making. While the draft ICO guidance aims to provide greater regulatory certainty, it should go further to ensure that recruiters integrate the necessary pillars of transparency and explainability in their AI deployment.

Our submission to the ICO primarily addresses the following concerns:

• The implications of involving third-parties in AI recruitment for the data rights of candidates.
• The different technologies used and different types of data collected.
• The use of candidate data for model training purposes.
• The role of Data Protection Impact Assessments (DPIAs).
• Meaningful human intervention and transparency in the context of ADM tools used in recruitment.

Read our full submission below.