IDPC participates in panel to discuss data protection and AI in Employment and Recruitment contexts

21 May 2025

‘AI in Employment: Balancing Risk, Reward, and Responsibility’ was the theme of a panel that Dr Marco Fagnano, legal counsel at the Information and Data Protection Commissioner (IDPC), took part in at the MDIA’s Digital Innovation Hub (DiHubMT). It addressed the legal and ethical challenges of AI use in the workplace.

He flagged AI systems used in recruitment, performance monitoring, and adverse employment decisions as high-risk under the EU AI Act, particularly where they rely on automated decision-making (ADM) and personal data processing. These uses fall under Article 22 of the GDPR, which restricts decisions made by automated means which produce legal or ‘similarly significant effects’.

Dr Fagnano emphasised the intrusiveness of AI tools that analyse job applications, assess personal traits, or allocate tasks—especially those involving biometric data or emotion recognition, which are largely prohibited under the AI Act due to discrimination and privacy concerns.

He highlighted the limited lawful bases for such data processing, noting that in employment contexts, consent is generally considered invalid due to the recognised power imbalances. Moreover, contractual necessity must be narrowly interpreted in the employment relationship. AI-driven profiling in recruitment may be seen as requiring explicit consent and transparency for instance.

The IDPC is actively preparing for its role as a market surveillance authority under the AI Act, strengthening its ability to assess AI systems from both a data protection and fundamental rights perspective. It is also collaborating with the MDIA to evaluate technologies—including generative AI—through national regulatory sandbox initiatives.

Finally, Dr Marco Fagnano noted the IDPC’s broader awareness efforts ahead of the AI Act’s enforcement, including outreach in critical sectors, and its contributions to EU-level initiatives such as the EDPB’s ChatGPT Taskforce and policy work on AI and personal data. These actions aim to ensure responsible AI deployment that respects legal standards and protects individual fundamental rights, such as privacy and data protection.