Enforcement
EDPB picks automated decisions in recruitment as the topic of its 2027 coordinated enforcement action
- Date
- Status
- adopted
- Body
- European Data Protection Board (EDPB)
- Reference
- Coordinated Enforcement Framework, zesde gecoördineerde actie (onderwerp gekozen in de plenaire vergadering van november 2026)
What it is about
The EDPB has chosen the topic of its sixth coordinated enforcement action (CEF): automated decision-making in recruitment, including AI-driven decision-making. The action focuses on the right not to be subject to a decision based solely on automated processing, and on the related right of access, in the use of automated candidate screening tools. Supervisory authorities will join on a voluntary basis in the coming weeks; the action itself starts in the course of 2027.
What this means in practice
If you use software that automatically screens or ranks applicants, expect questions from your supervisory authority in 2027 if it joins the action. Check whether decisions are taken without genuine human review (Article 22), and whether you can explain to an applicant who makes an access request how the tool reaches an outcome (Article 15). Which authorities will take part is not yet settled.
The GDPR articles concerned
Source: EDPB, nieuwsbericht van 11 november 2026 over de plenaire vergaderingchecked on 12 November 2026
Summary and practical reading by Praxikon. Not legal advice; the source prevails.
Connections
What connects to this development
Themes where this returns
The counterpart in the other law
Case law
- Dun & Bradstreet: right to an intelligible explanation of an automated decision, trade secrets are no absolute ground for refusal
2025-02-27 · final, Hof van Justitie van de EU (Eerste kamer), CK tegen Magistrat der Stadt Wien, met Dun & Bradstreet Austria GmbH als andere partij
- SCHUFA: a credit score on which third parties draw strongly is automated decision-making
2023-12-07 · final, Hof van Justitie van de EU (Eerste kamer), OQ tegen Land Hessen, met SCHUFA Holding AG als interveniënt
- Brillen Rottler: even a first access request can be abusive if made solely to claim compensation
2026-03-19 · final, Hof van Justitie van de EU (Vierde kamer), Brillen Rottler GmbH & Co. KG tegen TC
- Lindenberg: a data protection authority is a controller towards the complainant and must grant access
2026-11-05 · final, Hof van Justitie van de EU (Derde kamer), Joachim Lindenberg tegen Bayerisches Landesamt für Datenschutzaufsicht
- Council of State: DPA could fine DPG Media for routinely demanding ID copies, fine halved to 262,500 euros
2025-09-24 · final, Raad van State, Afdeling bestuursrechtspraak
Guidelines
- Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)
- Dutch DPA (AP) publishes position paper on the Digital Omnibus and the AI Omnibus
2026-01-13 · final, Autoriteit Persoonsgegevens
- EDPB and EDPS adopt Joint Opinion 2/2026 on the Digital Omnibus
2026-02-10 · final, European Data Protection Board en European Data Protection Supervisor
Enforcement and fines
- Dutch DPA fines Uber 824.99 million euros for automated driver deactivation
2026-08-21 · under appeal, Autoriteit Persoonsgegevens
- Netflix fined 4.75 million euros for failing to properly inform customers
2024-11-26 · under appeal, Autoriteit Persoonsgegevens
- Dutch DPA: Tax Administration still falls short of the GDPR on 10 of the 12 topics reviewed
2026-11-11 · final, Autoriteit Persoonsgegevens
- Dutch DPA study: algorithms and AI at debt collection agencies
2026-10-29 · final, Autoriteit Persoonsgegevens
- Clearview AI: 30.5 million euro fine and penalty orders for illegal facial database
2024-05-16 · final, Autoriteit Persoonsgegevens
Legislation in motion
- Proposal: reformulation of automated individual decision-making (Article 22 GDPR)
2025-11-19 · proposal, Europese Commissie
- European Parliament: joint ITRE-LIBE draft report, amendments tabled, no committee vote yet
2026-06-22 · under negotiation, Europees Parlement, commissies ITRE en LIBE (gezamenlijke commissie)
- Proposal: refusing requests that abuse the right of access (Article 12(5) GDPR)
2025-11-19 · proposal, Europese Commissie
- Council: Cyprus Presidency tables negotiating mandate, Coreper vote of 26 June 2026 cancelled
2026-06-22 · under negotiation, Raad van de Europese Unie, Antici-groep (vereenvoudiging) en Coreper
- Commission publishes Digital Omnibus proposal COM(2025) 837
2025-11-19 · proposal, Europese Commissie
Analysis6 of 14
- Agentic AI under the EU AI Act: how to govern autonomous agents
2026-07-07
- AI agents and GDPR Article 22: no hard stop, no consent fix
2026-10-14
- Regulators will look at automated candidate screening in 2027: what to put in place now
2026-11-13
- Agentic AI governance: obligations, controls and how to get started under the EU AI Act
2026-07-07
- AI agents in a Dutch municipality: a governance plan in five steps
2026-11-05
- The agent register: what to record for each AI agent
2026-11-05