Saatja: Grete-Liis Kalev - AKI </O=EXCHANGELABS/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=F58642EB43BA453BBE86E78700CFEE19-182E913C-C0>
Saaja: Victoria Sanduta
Teema: RE: Request for National and EDPB-Level Guidance on Psychometric Testing in Employment Contexts
Dear Victoria Sanduta,
Thank you for your letter.
Estonian Data Protection Inspectorate is currently in the process of updating our guideline on data protection in employment relations. We will consider including this issue in the guidelines.
Please be advised that we are unable to predict when the update of the guideline will be completed.
Kind regards,
Grete-Liis Kalev
lawyer
[email protected]
627 4138
ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST
Tatari 39 | 10134 Tallinn | Eesti
LinkedIn <https://www.linkedin.com/company/estonian-data-protection-inspectorate/> | YouTube <https://www.youtube.com/@andmekaitse>
<https://www.aki.ee/>
From: Victoria Sanduta <
[email protected]>
Sent: Monday, April 7, 2025 4:13 PM
Subject: Request for National and EDPB-Level Guidance on Psychometric Testing in Employment Contexts
Tähelepanu! Tegemist on välisvõrgust saabunud kirjaga.
Tundmatu saatja korral palume linke ja faile mitte avada.
Tähelepanu! Tegemist on välisvõrgust saabunud kirjaga.
Tundmatu saatja korral palume linke ja faile mitte avada.
Dear Data Protection Authority team,
I am writing to express growing concern within the privacy community regarding the widespread use of psychometric testing in recruitment and employment processes, and the absence of official national or EU-level guidance on the application of data protection rules to these practices.
As organizations across Europe increasingly integrate psychometric tools into hiring, internal mobility, and employee development, the legal uncertainties surrounding such processing are becoming critical. In particular, there is a lack of clarity on how to apply key provisions of the GDPR to these tools, especially when:
* Profiling is involved or decisions are made based on test results
* Special category data may be inferred (e.g., psychological traits, neurodivergence)
* Automated decision-making under Article 22 may be triggered
* Transparency, fairness, and explainability obligations must be met
* Consent and legitimate interest assessments are context-sensitive and ambiguous
Given the privacy-intrusive and potentially discriminatory nature of some of these tools, the current legal vacuum creates a fragmented and subjective landscape. Privacy professionals across the EU are left to make inconsistent, risk-based judgments without formal regulatory guidance, raising both legal and ethical concerns.
We respectfully urge your authority to consider providing national guidance on this topic and, if appropriate, to raise this matter within the European Data Protection Board (EDPB) for joint evaluation and coordinated action.
Such guidance would enhance regulatory consistency, support responsible innovation in HR technology, and uphold the data protection rights of individuals across Europe.
Thank you in advance for your consideration. I would welcome the opportunity to contribute to any consultation process your authority may initiate on this topic.
Kind regards,
Victoria Sanduta
Global Data Privacy Specialist
[email protected] <mailto:
[email protected]>
www.autoliv.com <http://www.autoliv.com>
***************************************************************
Consider the environment before printing this message.
To read the Companies' Information and Confidentiality Notice, follow this link:
https://www.autoliv.com/autoliv-email-disclaimer
***************************************************************