Spain's data protection agency warns a company that wanted to score résumés with AI: these are the safeguards

What it says

• The tool was going to analyze résumés, assign scores, and prioritize applications in recruitment and internal mobility. It was not yet in operation, but the company had already announced it to its workforce.
• The AEPD requires data protection by design and by default, risk analysis and, if the processing may entail a high risk, a prior impact assessment.
• It asks for clear information to candidates and workers about the processing of their data and about the role of the tool in the evaluation.
• On human intervention: for it to be effective, the decision-maker must be able to critically assess the score and make their own decision, not simply accept the result.
• If the decision depended solely on automated processing, the GDPR right not to be subject to such decisions would come into play. The warning (Article 58.2.a of the GDPR) is preventive and does not declare any infringement.

Text of warning AI-00009-2026 (PDF): www.aepd.es

The Tech Guardian summarizes and comments in its own words on third-party publications. The full information belongs to the original source, which we recommend you read.