GDPR Article 22 and Recruitment: What Keeping a Human in the Decision Really Requires

"Does the AI decide instead of me?"

For many HR leaders facing an automated recruitment tool, that's the first question that comes up — and one European law has answered precisely since 2018.

What Article 22 of the GDPR Actually Says

Article 22 of the General Data Protection Regulation (Regulation (EU) 2016/679) sets out, in its first paragraph, a simple principle: a person has the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects concerning them or similarly significantly affects them.

Paragraph 2 provides three limited exceptions to this principle — contractual necessity, authorization under EU or member state law, or the person's explicit consent — but even in those cases, it imposes minimum safeguards: the right to obtain human intervention, to express one's point of view, and to contest the decision.

What the SCHUFA Ruling Clarified

One point deserves attention: a recent ruling by the Court of Justice of the European Union (the SCHUFA case, 2023) clarified that a decision still counts as "exclusively automated" under Article 22 if human intervention is limited to formally rubber-stamping the system's output without genuine review — which shifts the question away from simply having a human "in the loop" toward how real their actual power of judgment is.

Why Recruitment Falls Within Article 22's Scope

A decision to reject or shortlist a candidate typically falls within the category of decisions producing a "significant effect" on the person concerned. A recruitment tool that let a system decide alone, without any genuine margin of judgment left to the recruiter, would therefore fall directly within the scope of Article 22 — along with the information and contestation obligations that come with it.

Keeping human decision-making power genuinely — not just formally — in place at every stage isn't one design option among others: it's a structural requirement of the text itself.

Frequently Asked Questions

Does AI-assisted resume screening automatically fall under Article 22?

Probably, as long as no genuine margin of judgment is left to the recruiter over the system's output — but the exact boundary depends on the precise configuration of the process, particularly what counts as a "genuine" human review under the SCHUFA ruling. (A point to settle with legal counsel case by case, not to interpret in marketing content.)

Does candidate consent cover automated screening without human intervention?

Article 22(2)(c) does provide an exception based on explicit consent, but its applicability within a candidate-employer relationship — marked by a power imbalance — is debated in legal scholarship and has, to our knowledge, no uniform answer. (To verify with legal counsel before any commercial claim relies on this basis.)

Is this obligation specific to the recruitment sector?

No — Article 22 applies to any individual automated decision producing a legal or significant effect, in any sector. Recruitment isn't named specifically; it's the structurally impactful nature of the decision for the person that brings it into scope. (Wording to confirm with legal counsel if the article needs to settle this point more precisely.)

Clarentia's Position

This requirement to keep a human in the decision doesn't make Clarentia the only market player capable of meeting it: it's a legal baseline shared by every actor processing candidate data in Europe, regardless of where they're based. At Clarentia, keeping genuine recruiter decision-making power at every stage is a design principle from the outset, not a compliance layer added afterward.

Cited Source

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), Article 22.