EDPB plans 2027 enforcement on automated recruitment

The European Data Protection Board (EDPB) has selected automated decision-making in recruitment as the subject of its 2027 coordinated enforcement action. It announced the initiative in its 11 November 2026 release, “EDPB adopts statement on review of the Republic of Korea adequacy, processor BCR recommendations, and selects topic for 2027 coordinated enforcement action”. The action will address compliance with the right not to be subject to decisions based solely on automated processing and the related right of access when candidate screening tools are used, including AI-driven tools. Data protection authorities will participate voluntarily, with the action scheduled to launch during 2027.

The same release announces the adoption, following public consultation, of final recommendations on binding corporate rules for processors (BCR-P). These enable transfers of personal data outside Europe to processors within the same corporate group, establishing enforceable rights and commitments to protection essentially equivalent to the GDPR. The recommendations already apply to all BCR-P holders. Holders and new or ongoing applicants should align their BCR-P during the approval process or through their 2028 annual update, depending on their circumstances.

On South Korea, the release reports that the European Commission’s report of 23 July 2026 confirmed the continued adequacy of protection for transfers covered by the 2021 adequacy decision. It also reports the EDPB’s support for the proposal to move to reviews every four years. Amendments to Korean legislation highlighted in the announcement include new rights to withdraw consent, request suspension of processing, and refuse automated decisions or request explanations where decisions significantly affect individuals’ rights or obligations. This account rests on the institutional announcement: the adopted documents, the report and the Korean statutory provisions have not been examined directly.