Transparency obligations for the use of Artificial Intelligence in human resources
The use of Artificial Intelligence technology (AI) is broad in business; as an ancillary tool to HR departments, AI systems may affect decision making procedures of working conditions, the choosing, hiring or evaluating of employees and candidates. In order to safeguard that the use of AI systems, in cases like the above, complies with their transparency obligations towards candidates/employees and allows for the exercise of their legal rights, companies need to adopt certain measures. These measures include having in place the appropriate legal documents that will accompany their processes. Below we navigate the recent transparency and information obligations introduced in Greece regarding the use of AI systems for decision-making in relation to human resources.
Pursuant to recent Law 4961/2022, which, inter alia, aims at creating an adequate regulatory background for the legitimate and safe exploitation of the potentials of Artificial Intelligence technology, every company that uses AI that influences any decision making procedure regarding employees or candidates and has impact on their working conditions, hiring or evaluation, need to provide adequate and distinct information to every employee or candidate, before the use of such a system (see article 9 of. L. 4961/2022). This type of information may take the form of a Notice/Policy that includes as a minimum every parameter on which decisions are based when using AI systems, without prejudice to cases where prior information and consultation is required. Companies need to ensure that no discrimination regarding gender, skin color, race, nationality or ethnic origin, genetic features, religious or other beliefs disabilities or chronic illness, age, marital or social status, sexual orientation, identity or gender characteristics is made by the systems and that all employees/candidates are treated equally.
The obligations described above need to be addressed along with the transparency obligations arising from GDPR regarding the protection of personal data through AI systems, when automated decision making is held, which produces legal effects to the data subjects (employees/candidates) according to article 22 GDPR[1].
Digital platforms[2], that are intermediaries between employers and employees as providers of systems that use AI to support the HR departments of companies in the aforementioned context that affects employees/candidates, are also subject to the obligations of article 9 of. L. 4961/2022 as described above.
Especially, notwithstanding the above, companies that use AI systems that are medium or large entities according to the provisions of article 5 and 6 of L. 4308/2014 are obliged to keep a Registry of AI systems that includes at least the following information:
(a) a description of the operating parameters, capabilities and technical characteristics of the system,
(b) the number and status of the natural persons concerned or likely to be concerned,
(c) the technical information concerning the supplier or external contractors involved in the development or operation of the system,
(d) the period of operation of the system; and
(e) the measures taken to ensure their safe operation[3].
Additionally, medium and large companies that meet said criteria need to adopt a Data Ethics Policy, which includes information on the measures, actions and procedures it applies in relation to data ethics in the use of AI systems; the Data Ethics Policy needs to be implemented[4] in the corporate governance statement[5].
The information obligations that Law 4961/2022 imposes, set the first Greek regulatory framework on the transparent use of AI systems in the work field and foreshadows a sequence of legislation that will support companies on the appropriate use of AI systems, which address both the needs of HR departments and the rights and freedoms of employees.
[1] Article 5 par. 1 a)- principle of lawfulness, fairness and transparency, Article 22: Automated individual decision-making, including profiling, par. 3.: “…….the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.”
[2] Article 68 L.4808/2021 ‘Digital platforms’ means undertakings acting either directly or as intermediaries and connecting providers through an online platform service providers or businesses or third parties with users or customers or consumers and facilitates the interaction between them or deal directly with them.
[3] Article 10 par. 1 of L. 4961/2022
[4]Article 10 par. 3 of L. 4961/2022
[5] According to article 152 L. 4548/2018
