ICO Report on AI Tools in Recruitment

This document is an outcomes report published by the ICO on 6 November 2024, focusing on AI tools used in recruitment. The report follows audit engagements conducted by the ICO with AI developers and providers from August 2023 to May 2024, aimed at ensuring compliance with UK data protection law. The audits identified issues such as unfair processing of personal data, including inferring characteristics from names and excessive data collection. The ICO made 296 recommendations to improve data protection compliance. Key areas addressed include fairness in processing personal information, transparency in how data is used, and the necessity of conducting Data Protection Impact Assessments (DPIAs). The report emphasizes the importance of defining roles between AI providers and recruiters, setting clear processing instructions, and identifying lawful bases for data processing. The ICO outlines best practices for organizations to mitigate privacy risks while utilizing AI tools in recruitment, aligning with the EU AI Act's high-risk designations.