The Information Commissioner's Office has recently published ‘AI tools in recruitment audit outcomes report’ in which they issue a series of recommendations to AI developers and users to ensure job seekers are protected during the recruitment process.

Using AI tools in recruitment: understanding the ICO’s guidance

The Information Commissioner's Office has recently published ‘AI tools in recruitment audit outcomes report’ in which they issue a series of recommendations to AI developers and users to ensure job seekers are protected during the recruitment process. As AI becomes progressively prevalent in recruitment, it undoubtably offers significant benefits including saving both time and money by sourcing potential candidates, summarising CVs, and scoring applicants. However, if not developed lawfully, these tools have the power to negatively impact potential applicants by unfairly excluding them from roles or compromising their privacy. Organisations looking to use AI in their recruitment processes need to be alive to this and take steps to limit such negative impact.

What did the ICO find?

To address these concerns, the ICO conducted audits on several providers and developers of AI tools for recruitment and subsequently published a report which summarises the key findings and recommendations. To benefit the AI developers and recruiters, it also provides detailed examples of good practice, case studies and lessons learnt. 
The scope of the audit covered the key areas of:

• Privacy management framework;
• Data minimisation and purpose limitation;
• Third party relationships;
• Information security and integrity;
• Transparency;
• Data protection impact assessments and risk management;
• Privacy trade-offs within AI, using personal information to train and test AI;
• Accuracy, fairness, and bias mitigation in AI;
• Human reviews in AI.

The audit revealed several issues with AI tools, such as a lack of accuracy testing, features leading to discrimination by having a search functionality that allowed recruiters to filter out candidates with certain protected characteristics, features estimating or inferring gender, ethnicity and other characteristics from job applications and names and tools collecting excessive personal information. 

What does the ICO recommend to overcome these issues?

The recommendations focused on a number of requirements under the law which ranged from: 

• Processing personal information fairly;
• Explaining the processing clearly;
• Keeping personal information collected to a minimum;
• Not repurposing or processing personal information unlawfully; 
• Conducting risk assessments to understand the impact to people’s privacy.  

The ICO’s investigation and findings highlight the responsibility that organisations have both in terms of understanding the potential adverse effects involved in using AI in the recruitment process and also for implementing the relevant steps to overcome those adverse effects. 

Helpfully, the ICO has published key questions for organisations looking to adopt AI tools for recruitment to ask during the procurement process, enabling them to seek clear assurances from developers and providers from the outset. The ICO encourages the organisations to consider:

• whether they have completed a date protection impact assessment and if not to complete this;
• what is their lawful basis for processing personal information using AI;
• whether they have documented responsibilities and set clear processing instructions;
• whether they have checked the provider has mitigated bias within the AI system;
• whether the AI tool is being used transparently;
• how they will limit unnecessary processing.   

What is clear is that organisations should not be put off from using AI to support their recruitment practices. Indeed, the ICO report noted several positive practices including providers equipping recruits with customised and adaptable AI models and providers working to remain transparent by sharing detailed information online about the AI and its operation, with the ultimate aim of fostering trust among users. What is clear, however, is that proper implementation of such AI tools is critical. 
Should you require any advice or guidance on implementing AI as part of your recruitment processes, please do get in touch.