Can an employer use an automated process in making shortlisting decisions?

Under the General Data Protection Regulation (2016/679 EU) (GDPR), which is in force from 25 May 2018, individuals have the right not to be subject to a decision based solely on automated decision-making. The right applies where the decision would significantly affect the individual, which would cover a decision on whether or not to shortlist someone for employment.

There is an exception to this right where automated decision-making is "necessary" to enter into a contract. The guidelines on automated decision-making under the GDPR produced by the Article 29 Data Protection Working Party state that this exception could apply to allow solely automated shortlisting decisions if this is necessary due to an exceptionally high volume of applications for a vacancy (it gives the example of tens of thousands of applications). However, in most cases, it is unlikely that automated decision-making would be "necessary", as it will usually be possible to make the shortlisting decision with human intervention.

Even where the exception does apply, the employer can make shortlisting decisions on a solely automated basis only if it informs the individual of this and puts in place safeguards, including the right for the individual to require human intervention in the processing, to express a view and to contest the decision. The employer must ensure that there is a procedure in place to allow staff to review the decision and make a new assessment of whether or not to shortlist an individual, if he or she objects.