Policy
Extra Rights You Get Applying to a European Employer
Applying to an employer established in the EU gives you one right no US law matches. GDPR Article 22 is the right not to be subject to a hiring decision based solely on automated processing with legal or similarly significant effect, and where such a decision is allowed, to demand human intervention, state your view, and contest the outcome. A 2023 EU ruling confirmed an automated score can itself count as the decision, even where a person formally signs off. The protection follows the employer's establishment, not your passport.
Where Olive fits
Open a role and see what the work shows
An Olive report carries no automated decision and no composite score to contest in the first place: a person writes each of six findings against the evidence behind it, and hands the candidate the same copy the employer reads, on every tier.
Rank your shortlistWhat Article 22 Actually Gives You
GDPR Article 22(1) gives you the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you 1. The regulation's own recitals name 'e-recruiting practices without any human intervention' as exactly the kind of thing this covers.
Where a solely automated decision is allowed at all, on a contract or explicit-consent basis, Article 22(3) requires the employer to give you at least three safeguards: the right to obtain human intervention, to express your point of view, and to contest the decision 4. This has applied since 2018, well before the EU AI Act existed, so it does not wait on any AI-specific legislation to take effect.
A 2023 ruling narrowed the room an employer has to argue this away. In the SCHUFA case, the Court of Justice of the EU held that an automated score can itself be 'automated decision-making' under Article 22 where whoever receives it draws strongly on it to decide, even though a separate party formally makes the final call 2. It concerned credit scoring rather than hiring, and no court has yet applied it to a candidate score directly, but the structural point travels: a human rubber-stamping a machine's output is not automatically outside Article 22 just because a person pressed the button. A hiring team that wants the safety of a human decision has to show the human actually decided something.
How to Send the Request
Ask for two things, by their statutory names, rather than a general appeal to 'my GDPR rights'. Under Article 15(1)(h), a subject access request reaches the automation itself: where automated decision-making exists, you are entitled to know it exists and to receive meaningful information about the logic involved, plus the significance and envisaged consequences for you 3.
Under Article 22(3), where the decision was solely automated, you can separately ask for human intervention, a chance to give your side, and a formal contest of the outcome 4. Send both requests in writing and keep a copy of what you sent and when, since a later contest is easier to make with a paper trail than without one. There is a clock on the reply: under Article 12(3), the employer must act on a request under Articles 15 to 22 within one month of receiving it, extendable by two further months where requests are complex or numerous, so silence past the month is itself something to point at 3.
'Meaningful information about the logic' sounds vague until a court defines it, and one has. In a 2025 ruling on automated credit scoring, the Court of Justice of the EU held that a controller facing a trade-secret objection still has to hand the underlying material to the regulator or a court for balancing, and that a proper explanation means the procedure and principles actually applied to reach that specific result, not the algorithm or the source code 5. That is a realistic bar for what a good-faith answer looks like, and a fair one to hold an employer to when the reply comes back thin. If a report or a set of findings comes back to you as part of that answer, what it means for the employer's own legal exposure to hand you the identical document is worth reading, since the same transparency that helps your request also shapes what an employer is willing to put in writing.
Where the Right Stops
The whole right hinges on one word: solely. A hiring process with genuine human judgment in it, someone who can and does vary the machine's recommendation, sits outside Article 22 entirely, and 'a person reviewed it' is the first argument an employer's counsel will make. The regulation does not define exactly how much human involvement is enough, so a real dispute over a specific process can turn on facts your request alone will not settle.
The SCHUFA reasoning cuts the other way on this point, and it is worth naming to an employer who leans on the defense too quickly: a human who receives the score and draws strongly on it without genuinely varying it is not obviously the kind of intervention Article 22 has in mind, even though the same ruling stops short of saying every human sign-off is meaningless. Where the process is contested, the facts of what the reviewer actually did will decide it, not either side's label for the step.
The EU AI Act adds a second, later-arriving layer rather than replacing this one. Its high-risk hiring obligations were originally due in August 2026, but a 2026 deferral pushed the compliance date to December 2, 2027 for recruitment systems, without narrowing what counts as high-risk once the date arrives 6. Until then, GDPR is the operative right, and it has applied since 2018, with no gap for a candidate to fall through while the newer law is still arriving.
Is This Worth Using?
It is worth using where the facts fit: a rejection you believe was decided by a tool alone, at an employer established in the EU or EEA, is exactly the case Article 22 was written for, and the request costs you a letter and a wait. Where the facts do not fit, mainly because a person genuinely reviewed the outcome, the request still gets you the logic explanation under Article 15, which is worth having on its own.
None of this depends on your own citizenship or where you happen to be sitting when you apply. Under Article 3, the regulation covers processing done in the context of an employer's EU or EEA establishment regardless of where the processing itself happens, and its protection applies whatever your nationality or place of residence 1. If you're weighing an application against a US-based alternative, checking which US state law, if any, would cover the same application shows plainly how much further the EU version reaches by comparison, and how thin the American side of that comparison currently is, since almost nothing on the US list matches Article 22's human-intervention right at all.
Common questions
What is GDPR Article 22?
A right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. It has applied to any EU or EEA employer's processing since 2018, well before the EU AI Act existed 1.
Does a human reviewing the score remove my Article 22 right?
It can, but not automatically. A 2023 EU court ruling held that an automated score can itself count as the decision where whoever receives it relies on it heavily, even if a person formally signs off, so a token human step may not be enough 2.
What can I actually ask an EU employer for?
Can an employer refuse to explain its algorithm as a trade secret?
Not simply by claiming one. A 2025 EU court ruling requires the controller to give the disputed material to the regulator or a court for balancing rather than ending the request, and defines a proper explanation as the procedure and principles actually applied, not the source code 5.
Do EU AI Act hiring rules apply to my application right now?
Not yet. The high-risk recruitment obligations were deferred from August 2026 to December 2, 2027. GDPR's Article 22 and Article 15 rights are unaffected by that timeline and have applied since 2018 6.
References
- 1. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 22 - Automated individual decision-making, including profiling publications.europa.eu Article 22(1)'s right against a solely automated decision with legal or similarly significant effect; Article 3(1) and Recital 14 on establishment-based scope regardless of nationality or residence.
- 2. Judgment of the Court (First Chamber) of 7 December 2023, Case C-634/21, OQ v Land Hessen (SCHUFA Holding AG intervening) publications.europa.eu An automated score can itself be the decision under Article 22, even where a third party formally acts on it.
- 3. Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal L 119, 4.5.2016 publications.europa.eu Article 15(1)(h)'s access right to the existence and logic of automated decision-making; Article 12(3)'s one-month response deadline, extendable by two further months.
- 4. Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal L 119, 4.5.2016 publications.europa.eu Article 22(3)'s three safeguards: human intervention, a stated point of view, and a contest.
- 5. Judgment of the Court (First Chamber) of 27 February 2025, Case C-203/22, CK v Magistrat der Stadt Wien (Dun & Bradstreet Austria GmbH), ECLI:EU:C:2025:117 publications.europa.eu What 'meaningful information about the logic' obliges a controller to actually hand over.
- 6. Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) publications.europa.eu The deferral of the EU AI Act's high-risk recruitment obligations to December 2, 2027.
6 sources, numbered by first appearance. How Olive sources claims
General guidance, not legal advice. Hiring rules differ by state and country and change often; check anything here against your own counsel before you act on it.
Olive assesses how a person works with AI. It does not detect AI-written documents, and it never produces a score, a ranking, or a match percentage for a person. Candidates read the same report the employer reads.