EDPB targets AI candidate screening in its 2027 enforcement drive

EDPB targets AI candidate screening in its 2027 enforcement drive

11 November 2026: Europe's data protection authorities will spend 2027 checking how employers and recruitment platforms use automated candidate screening, including AI tools, after the European Data Protection Board picked automated decision-making in recruitment as the topic of its sixth coordinated enforcement action. The same plenary made its recommendations on processor binding corporate rules final, and every holder now has to bring its rules into line.

Not yet independently verified. The EDPB has named the topic but not the questionnaire or which national authorities will take part, so the scope of the 2027 action may narrow before it starts. We will update this when it can be confirmed, and remove this note.

Hiring tools are the 2027 target

The coordinated action will focus on two GDPR rights: the right not to be subject to a decision based solely on automated processing, and the related right of access, "in the context of the use of automated candidate screening tools, including AI-driven ones". National authorities will join on a voluntary basis "in the coming weeks", and the action itself starts "in the course of 2027".

Earlier coordinated actions ran the same way: each joining authority sends questionnaires to organisations in its country, opens formal investigations where the answers warrant it, and the Board publishes a combined report. An employer that screens CVs with software, or a vendor that sells it, should expect questions on three points: whether any rejection happens with no human review, what candidates are told about the logic, and how an access request is answered when the decision came from a model.

Our catalogue lists 19 applicant tracking software products, the category most of these tools sit in.

Processor BCRs: final, with a 2028 deadline

Binding corporate rules for processors (BCR-P) let a group transfer personal data outside Europe to processors within the same group. After a public consultation, the Board adopted the final version of its recommendations on what a BCR-P application must contain and the principles the rules must follow.

The recommendations "are now applicable to all BCR-P holders". Holders, and every new or ongoing applicant, should bring their BCR-P in line "either during the application process or as part of their 2028 annual update, depending on their specific situation". The Board also published a report on the consultation and a track-changes version showing what moved since the draft.

For a cloud or outsourcing group that relies on approved BCR-P, the practical step is to compare its approved rules with the track-changes version now, so the 2028 update is a filing rather than a renegotiation with the lead authority.

Korea's adequacy, four years on

The Board's statement on the first review of the European Commission's adequacy decision for the Republic of Korea, in place since 17 December 2021, welcomes amendments to Korea's Personal Information Protection Act. They add a general right to withdraw consent, a right to ask for processing to be suspended, and a right to refuse an automated decision, including one made by an AI system, or to ask for an explanation when it significantly affects the person.

The Board also welcomed the new rules that require cross-border transfers to rely on specific transfer tools rather than consent alone, and the stronger enforcement powers of the PIPC, Korea's regulator. It agrees with the Commission's proposal to review the decision every four years.

EDPB Chair Anu Talus said the 2025 mutual recognition "represented a major step confirming the growing alignment between both regulatory frameworks".

Related on TrustList:

• Spott raises $21 million Series A for its AI system for recruitment agencies
• Bullhorn restores its staffing platform after a three-day cyber incident

Sources

• EDPB: EDPB adopts statement on review of the Republic of Korea adequacy, Processor BCR recommendations and selects topic for 2027 coordinated enforcement action, 11 November 2026
• IDPC Malta: copy of the EDPB release, 12 November 2026