AI in Recruitment: ICO makes hundreds of recommendations

The Information Commissioner’s Office (ICO) has shared some key questions organisations should ask when procuring AI tools to help with their employee recruitment.

The advice comes in recognition that the recruitment function is increasingly using AI related tools to improve the efficiency of the hiring process, from sourcing potential candidates to summarising CVs and scoring applicants. Alongside this is the recognition however, that AI tools may negatively impact jobseekers who could be unfairly excluded from roles or have their privacy compromised.

Having audited several providers and developers of AI tools for the recruitment industry, the ICO says it uncovered considerable areas for improvement, such as ensuring personal information is processed fairly and kept to a minimum, and clearly explaining to candidates how their information will be used by the AI tool.

In total there were almost 300 recommendations made for providers and developers to improve their compliance with data protection law – all of which have been accepted or partially accepted.

“All recruiters need to take these recommendations seriously,” says Sue Turner, Founder and Director of AI Governance Ltd. “Some of this is simply compliance with existing regulations like GDPR, but other recommendations highlight the need to go further when using AI tools.”

Turner adds that there’s more to do beyond the ICO’s recommendations, such as checking whether and how your technology and systems suppliers are using AI. “This needs to be built in to your procurement practices,” she says. Turner also advises organisation to stay up to date with wider regulation such as the EU AI Act which will outlaw HR practices like using AI for emotion recognition from January 2025.

Ian Hulme, ICO Director of Assurance commented: “AI can bring real benefits to the hiring process, but it also introduces new risks that may cause harm to jobseekers if it is not used lawfully and fairly,” said. “Organisations considering buying AI tools to help with their recruitment process must ask key data protection questions to providers and seek clear assurances of their compliance with the law.”

Among the questions to ask before procuring an AI tool for recruitment are:

1) Have you completed a DPIA?

A Data Protection Impact Assessment (DPIA) helps you to ask the right questions of your provider and should be carried out prior to using an AI tool, ideally at the procurement stage. Your DPIA should be kept up to date as the processing and its impacts evolve. Taking this approach will also help meet your accountability obligations under data protection law.

2) What is your lawful basis for processing personal information?

If you are processing personal information, you must identify an appropriate lawful basis to rely on, such as consent or legitimate interests. If you plan to process sensitive special category data, such as racial, ethnic origin or health data, you must meet a specific condition under the law.

3) Have you checked the provider has mitigated bias?  

The audit revealed that some AI tools were not processing personal information fairly – for example, by allowing recruiters to filter out candidates with certain protected characteristics. You must ensure that personal information will be processed fairly by monitoring for potential or actual fairness, accuracy or bias issues in the AI tool and its outputs. These should be raised with the provider so they can be addressed appropriately. You should seek clear assurances from the AI provider that they have mitigated bias and ask to see any relevant documentation.

4) Is the AI tool being used transparently?

You must ensure that you inform candidates how an AI tool will process their personal information. You should do this with clear privacy information, that explains how and why the tool is being used and the logic involved in making predictions or producing outputs that may affect people. Candidates must be informed how they can challenge any automated decisions made by the tool.

The ICO will be delivering a webinar on Wednesday 22 January 2025 for AI developers and recruiters so they can learn more about the findings and how they can be applied. Register for the webinar here.

Find out more about the AI tools for recruitment outcomes report here.