An employer trains an automated hiring screen on historical HR data and rejects EU candidates with no human review path, DPIA, or bias assessment, despite significant effects on applicants. Which GDPR-aware concern is most accurate?
Select an answer to reveal the explanation.
Short Explanation
If a model trained on yesterday's biases quietly rejects people with no appeal hatch, GDPR's automated-decision and fairness alarms should ring. Hiring AI is still personal-data processing with human stakes. Do the DPIA-level thinking and keep meaningful human oversight where required.
Full Explanation
An employer that trains an automated hiring screen on historical HR data and rejects EU candidates with no human review path, DPIA, or bias assessment, despite significant effects on applicants, raises the GDPR-aware concern that AI/ML systems processing personal data for hiring must meet GDPR principles—including fairness, transparency, and automated decision-making safeguards—not ignore bias and accountability risks. Quiet model rejections without appeal hatches are high-stakes civic employment harms. Claiming historical HR training data are always anonymous fails when training sets relate to identifiable people or encode biased labels. Saying AI hiring tools are governed only by US EEO narratives, not European DP law, fails GDPR applicability. Asserting candidate profiling never qualifies as solely automated decision-making if a CV PDF is stored fails—storage of a PDF does not create meaningful human intervention. Exam caveat: Article 22 restricts solely automated decisions with legal or similarly significant effects unless an exception and safeguards apply; DPIAs commonly attach to systematic hiring profiling. Operational check: add meaningful human review, complete a DPIA, test for bias, explain logic at an appropriate level, provide contest channels, and halt fully automated rejection pipelines that lack safeguards.