Being screened out of a recruitment process by a piece of software is not, in itself, discrimination, however often that is the word people reach for when they describe it. In law, discrimination is unfavourable treatment on a ground the statute expressly protects, and for access to employment that list is set by article 4.2.c) of the Spanish Workers’ Statute, sex, marital status, age, racial or ethnic origin, social condition, religion, political opinion, sexual orientation, trade union membership, language and disability. If the rejection can be traced to one of those grounds, even indirectly and even if nobody ever wrote it down, the decision is void, the burden of proving there was no discrimination shifts to the employer and compensation can be claimed. If the rejection was arbitrary, clumsy or absurd but no protected ground lies behind it, what remains is data protection law, which gives you considerably less, though not little. The whole claim turns on that initial classification, which is why it is the first thing to examine.
What the algorithm does with your application and why it gets it wrong
A recruitment algorithm is a statistical rule. It is trained on the CVs of people the company hired in the past and those it turned down, and from them it learns which features appear more often in the first group. When your application arrives it is compared with that pattern and given a score. Simple systems filter by keywords and discard whatever lacks them. More sophisticated ones analyse a video interview, tone of voice, pauses, facial expression, or a game-style test. None of them knows whether you can do the job. It knows whether you resemble the people the company already had.
If the workforce the system learned from was mostly male, the system learns that being male scores. The best-known case is Amazon, which in 2018 withdrew a recruitment tool that penalised CVs containing the word “women’s”. Bias is rarely that explicit. What usually happens is that the system relies on variables that look neutral and work as stand-ins for a protected ground. The year of graduation reveals age. A two-year gap in a CV coincides with maternity or illness. A postcode correlates with origin. A foreign surname or a university the system does not recognise lowers the score without anyone having decided it. Add to that plain material errors, a PDF the program cannot parse or a job described in different words from those in the advert.
You have the right to know a machine assessed you
The General Data Protection Regulation obliges the employer to tell you, at the point it collects your CV, whether automated decision-making exists, including profiling, and to give you meaningful information about the logic involved and the envisaged consequences. That obligation sits in articles 13 and 14 of the Regulation and is repeated in article 15, which governs the right of access, so you can request that information after the rejection as well. The employer has a statutory period in which to reply, one month as a general rule, and silence can be taken to the Spanish Data Protection Agency in the same way as a refusal.
Article 22 of the same Regulation goes further. Nobody has to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them, and being kept out of a job qualifies. The employer may rely on the decision being necessary to enter into the contract, or on your consent, but even then you keep the right to obtain human intervention, to express your point of view and to contest the decision. The argument almost always comes down to the word “solely”. Many employers maintain that a human resources officer always reviews the outcome in the end. The Court of Justice of the European Union settled a similar point in the SCHUFA judgment of 7 December 2023, case C-634/21, on credit scores, and the reasoning carries across. If the machine’s score determines the result in practice and the person merely rubber-stamps it, the decision is automated even though it bears a human signature. Organic Law 3/2018 on Data Protection completes this framework in Spain.
When the rejection is discriminatory the law changes sides
Through data protection you obtain information and, at most, a human review of the rejection. When discrimination is proved you obtain something else. Article 17 of the Workers’ Statute declares void any employer decision that gives rise to discrimination in employment, and access to employment is included. Law 15/2022 on equal treatment and non-discrimination adds that well-founded indications are enough to put the employer to proof of an objective and reasonable justification, and it presumes moral damage, which is compensated without proof of financial loss. The Law on the Social Jurisdiction contains the same reversal of the burden of proof and provides a fast-track procedure for the protection of fundamental rights.
Indirect discrimination is what matters here. The system does not need a rule that says “nobody over fifty”. It is enough that an apparently neutral criterion, such as requiring a recent degree or an uninterrupted career, disproportionately disadvantages a protected group without the employer being able to justify it by the nature of the job. A candidate never sees the algorithm, but does see the advert, the form, the video interview questions and, on request, the information about the logic involved. That is how indications are built. Without them, the claim remains a complaint.
Article 23 of Law 15/2022, which mentions artificial intelligence and algorithms, is cited a great deal, but it is a statement of principle addressed mainly to public administrations and cannot ground an individual claim. The useful basis is ordinary anti-discrimination protection applied to a new instrument.
We practise in this field, and the first thing we do is obtain from the employer the information on how the decision was taken before classifying anything, because that reply determines whether there is an employment case, a data protection case or neither, as set out on our employment law page.
The AI Regulation, what helps you now and what does not yet
Regulation (EU) 2024/1689 classifies as high-risk, in its Annex III, systems used to recruit or select people, in particular to filter applications and evaluate candidates. It imposes on those systems effective human oversight and control over the quality of the data they are trained on, and on the employer using them a duty to inform workers and their representatives before deployment, together with a right for the affected person to a clear explanation of the role the system played in the decision. The problem is the timetable. The bulk of the Annex III obligations has been postponed to December 2027 by the so-called Omnibus Regulation, so you cannot base a claim on them today. What has been in force since February 2025 is the ban on systems that infer emotions in the workplace, which on the prevailing reading covers video interviews that score gestures and tone of voice. In Spain the supervisory authority is the Spanish Agency for the Supervision of Artificial Intelligence, AESIA, which can fine the employer but does not give you the job back or compensate you.
Another provision already in force is the right to information about algorithms that the so-called rider law of 2021 inserted into the Workers’ Statute. Workers’ legal representatives are entitled to know the parameters, rules and instructions on which algorithms affecting access to and retention of employment are based. It is a right of the works council, not of the candidate, but in a company with union representation it is the route by which someone gets to see inside the system that rejected you.
A job is not the same as a loan or an account on a platform
Article 22 GDPR applies to any significant automated decision, but each scenario has its own sector rules and its own forum, and confusing them costs months.
| Who rejects you | Governing rules beyond the GDPR | Where to claim |
|---|---|---|
| An employer in a recruitment process | Workers’ Statute and Law 15/2022 | Social Court, Data Protection Agency and Labour Inspectorate |
| A bank refusing a loan on a “scoring” basis | Law 16/2011 on consumer credit, which requires a creditworthiness assessment, and the SCHUFA doctrine | Bank’s customer service, Bank of Spain, Data Protection Agency and civil courts |
| A delivery platform deactivating your account | Law 12/2021, with the presumption of employment and the right to information about algorithms | Social Court and Labour Inspectorate |
| A public body refusing a benefit | Law 40/2015, which regulates automated administrative action | Administrative appeal and administrative courts |
| A social network or marketplace closing your account | Regulation (EU) 2022/2065 on Digital Services, which requires a statement of reasons and an internal complaint system | Platform’s internal system, out-of-court settlement and civil courts |
Banks also use automated systems to block transactions and detect fraud, and what happens when those fail is explained in the article on bank refunds after phishing. Marketplaces decide by system who sells and who gets paid, something already covered in relation to third-party seller scams on Amazon. Employment differs from every other scenario in one significant respect, which is that discrimination in access to employment is a very serious infringement under the Law on Infringements and Penalties in the Social Order, so the Labour Inspectorate can act on its own initiative or at your request.
Where you claim and what you get in each place
Each body delivers something different. The Spanish Data Protection Agency can order the employer to honour your rights of access and human intervention and can impose very high fines, but it does not compensate you. Compensation for unlawful data processing is recognised by article 82 GDPR and has to be sought in court. The Labour Inspectorate can issue requirements, draw up a report and impose penalties, and its report carries considerable evidential weight if the matter goes to trial, but it does not compensate you either. The social court is the only forum that can declare the rejection void, order the employer to compensate you for moral damage and order the practice to stop. AESIA supervises the system, not the candidate.
If the employer did not build the algorithm but bought it from a vendor, the employer that decided to use it is the one answerable to you. Under data protection law it is the controller and the vendor is a processor acting on its behalf under article 28 GDPR, and under the AI Regulation the employer is the deployer. That the system belonged to a third party is no defence against the candidate, even if the employer can later seek recourse against the vendor. How the claim is framed, in what order and on what basis in each forum is the lawyer’s work, and it changes depending on whether the company has a works council and whether the vacancy is public or private.
What you can do today without waiting for anyone
Save the complete job advert with its date, because it is taken down from the portal as soon as the post is filled. Take screenshots of every screen in the process, the form, the video interview questions and the test, and of the rejection email or message with its time stamp. Download the portal’s or the employer’s privacy policy as it stood on the day you applied, because they change and nobody later remembers the earlier version. Do not delete your candidate account or ask for erasure of your data yet, because that history is your evidence and some employers purge it the moment the right to erasure is exercised. Do not sign any confidentiality agreement in exchange for an explanation of the reason. Do not reapply with altered details to “test” the system, because that taints any later claim. And do not publicly accuse the employer on social media until you have the information in hand, because an accusation of discrimination without indications can be turned against you.
If the process asked for a criminal record certificate, check that what appears is what should appear, because a record that is eligible for cancellation but still shows up is a guaranteed rejection and can be avoided. Bear in mind too that time limits in the social jurisdiction are short and run from the day you received the rejection, not from the day you suspected an algorithm was behind it.
What you risk by claiming on your own
The concrete risk in these matters is twofold. A poorly framed information request draws a template reply that complies on paper and closes the route to the Agency without you having learned anything useful, and labelling as discrimination what was merely an arbitrary rejection destroys the credibility of the claim while the time limit on the route that did have prospects runs out. We examine whether a protected ground is present, obtain from the employer the information on how the decision was taken and take your case to the forum where something can be obtained, whether the Agency, the Inspectorate or the social court. You can call +34 677 841 007 or write through the contact page, and the consultation is handled by a lawyer from our employment law team. When you call, have to hand the advert, the screenshots of the process, the rejection message with its date, a list of the tests you took and, if you believe the cause was age, sex, origin, a disability or any other protected circumstance, the specific detail in your profile that reveals it, because that decides where to start.
Frequently asked questions
How do I know whether an algorithm rejected me rather than a person?
There are clear signs. A rejection that arrives within minutes or at an impossible hour, an identical message sent to every candidate, a process that consisted only of uploading a CV and completing a test or a video interview with nobody at the other end, or a privacy policy that mentions “automated decision-making” or “profiling”. In any event you are entitled to ask in writing and the employer is obliged to tell you.
Can I demand that a person review the rejection and explain the criteria?
Yes. The General Data Protection Regulation gives you the right to human intervention in the decision, to express your point of view and to contest it, as well as to receive meaningful information about the logic the system applied. You have no right to see the code or to be handed the exact formula, but you do have the right to know which factors weighed and in which direction.
Who is liable if the employer bought the algorithm from another company?
The employer that decided to use it in its recruitment process is the one answerable to you. It is the controller of your data and, under artificial intelligence rules, the deployer of the system. The vendor being a third party is no defence for the employer, even if it can later claim against that vendor.
Is it worth claiming over an automated rejection?
It depends on what you are after. If what you want is that particular job, a claim rarely gets it back, because the post is filled by someone else while the claim is pending. If a protected ground lies behind it, such as age, sex, origin or disability, and there is some indication to support it, it is worth it, because the burden of proof shifts to the employer and moral damage is compensated. If there is no protected ground and no indication, only a feeling that the system was unfair, the sensible course is to exercise the right of access to find out what happened and spend nothing more, unless the reply uncovers something.