EDPB Selects AI Recruitment for 2027 Enforcement Action

The European Data Protection Board said in an announcement that automated decision making in recruitment will be the subject of its 2027 coordinated enforcement action. Participating data protection authorities will examine automated candidate screening tools, including those using AI, with a focus on the right not to face decisions based solely on automated processing and the related right of access.

Authorities will join the action voluntarily in the coming weeks, ahead of its launch during 2027. This will be the EDPB's sixth coordinated enforcement action.

The board also reviewed South Korea's data protection framework and supported moving its EU adequacy review to a four year cycle. It noted that amendments to South Korea's Personal Information Protection Act added rights to withdraw consent, suspend personal data processing, refuse certain automated decisions and request explanations.

The EDPB also adopted final recommendations for Processor Binding Corporate Rules, which govern transfers to processors within the same corporate group outside Europe. Current holders and applicants must align their rules during the application process or through their 2028 annual update, depending on their circumstances.