Use the applicable legal-obligation basis: Which conclusion is most supportable?
Consent is one possible GDPR basis, not a universal requirement; the stated legal obligation may support processing if conditions apply.
The question
Under the GDPR in the EEA, an employer uses an AI tool to screen applicants. A documented applicable legal obligation requires the screening, while the employer proposes collecting consent from every applicant. Which conclusion is most supportable?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Require consent because applicant screening involves personal data.Personal-data processing requires a lawful basis, but GDPR does not make consent the universal basis for employment screening.
- Rely on legitimate interests without examining the stated obligation.Legitimate interests may sometimes apply, but ignoring the documented legal obligation fails to analyze the basis most directly described.
- Process the information without a lawful basis because screening is mandatory.A mandatory organizational activity still requires a GDPR lawful basis and compliance with applicable principles and safeguards.
- Use the applicable legal-obligation basis, if its conditions are met. ✓The facts identify a possible legal-obligation basis; consent is not automatically required when another applicable GDPR basis supports processing.
The trap
Identify the factual basis first; do not assume consent merely because individuals are being evaluated. How to remember it
Consent is one possible GDPR basis, not a universal requirement; the stated legal obligation may support processing if conditions apply.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- Assess purpose compatibility and lawful basis before: What should procurement require first? →
- Collect only age band and region: Which action best applies minimization? →
- Treat it as personal data because reidentification remains: How should the dataset be treated for the agency’s →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.