Bias, Privacy and Data Protection Risks

Covering Assessment Criterion 3.2 of FREE08 – People Professionals and Artificial Intelligence (AI), this video addresses two of the most consequential risk categories that people professionals encounter when using AI tools: algorithmic bias and data privacy. The discussion engages directly with the Equality Act 2010 and its protected characteristics as a legal framework for understanding when AI-driven decisions in HR contexts can cross into unlawful discrimination. Recruitment is examined as a concrete domain where these risks materialise, with particular attention to how AI screening tools can systematically disadvantage candidates from underrepresented groups when trained on historically skewed data.

The video looks closely at why algorithmic bias is so difficult to detect in practice, given the opaque mathematical processes that underlie AI decision-making. Rather than examining explicit or intentional discrimination, the discussion focuses on how bias is inherited from historical data and can be amplified rather than corrected through automated systems. This connects directly to the monitoring responsibilities that fall on people professionals, including how to assess whether AI-driven outcomes are producing equitable results across different demographic groups rather than simply deferring to the output as neutral or objective.

On data privacy, the video draws on the UK GDPR and the Data Protection Act 2018 as the regulatory backdrop for handling sensitive employee information — covering salaries, health records, performance data and disciplinary matters — within AI environments. Cloud-based, third-party AI tools receive specific attention, including questions about data storage, processing arrangements, and whether using such systems is covered by an organisation's existing privacy notice. The video also addresses the particular risks arising when AI tools are used to draft HR documents such as grievance responses, where sensitive personal details are shared with external systems that may store or use that content beyond its immediate purpose.