Toto-Rex's story
Toto-Rex wants to know why.
So Toto-Rex writes to the company: 'Please send me a copy of my personal data, including any interview notes and scores.'
Weeks later, a file arrives. One line says: 'Video interview score: 42.'
Toto-Rex wonders: what does 42 mean, and who decided?
Toto-Rex's story is made up. The rules in this video are real.
The short answer
Not always. But data protection law gives you two useful tools.
The details
Tool 1: a subject access request.
You can ask an organisation for a copy of the personal data it holds about you.
That can include personal data in interview notes, assessment results, and recorded reasons for rejection.
Some information may be withheld under legal exemptions.
In the UK, the organisation must usually respond within one month, and usually cannot charge you.
A subject access request may help you understand what happened.
It does not guarantee a new feedback report or a different outcome.
The EU GDPR gives a similar right of access.
Tool 2: rights over automated decisions.
In the UK, a significant decision is one with a legal or similarly significant effect on you.
If such a decision about you is made solely by automated means, the organisation must have safeguards.
It must give you information about the decision.
You can make representations, obtain human intervention, and contest the decision.
These rights depend on how the decision was made, not on whether the software is called AI.
If you think the rejection was discriminatory, you can also ask the employer to reconsider.
Useful to know: you do not need special wording. You can ask for a copy of your personal data in writing or out loud.
Real-life examples
Real life: Illinois and AI video interviews.
Since 1 January 2020, Illinois has had a law for employers that use AI to analyse recorded video interviews for jobs based in Illinois.
Before the interview, the employer must tell applicants that AI may be used to analyse the video.
It must explain how the AI works and what general types of characteristics it uses to evaluate applicants.
Covered employers must get the applicant's consent before the interview.
Employers may share the video only with people whose expertise or technology is needed to evaluate the applicant.
If the applicant asks, the employer must delete the video within 30 days, and tell others who received copies to delete them too.
Real life: the EU's highest court on explanations.
In Austria, a mobile phone company refused a customer a contract after an automated credit check by Dun & Bradstreet Austria.
In February 2025, the Court of Justice of the European Union said that, for an automated decision like this, she was entitled to an explanation of how it was made.
The company had to describe the procedure and principles actually applied, in a way she could understand and use to challenge the decision.
Handing over a complex formula or algorithm would not be enough.
Where a company claims trade secrets, it must give the information to the regulator or court, which decides what can be shared.
This is an EU ruling. UK courts are not bound by it.
Real life: what the UK regulator found.
The ICO found that some AI recruitment tools collected far more personal information than needed, and kept it indefinitely to build large databases of potential candidates without their knowledge.
The tools it reviewed were designed to support human recruiters, not to make decisions without human input.
Real life: New York City.
Employers using covered automated hiring tools must tell candidates who live in New York City at least 10 business days before use.
If it is not on the employer's website, candidates can ask in writing for the type and source of data collected and the retention policy.
The response is normally due within 30 days. If disclosure would break the law or interfere with a law-enforcement investigation, the employer must explain why it cannot share the information.
Back to Toto-Rex
So, back to Toto-Rex's '42'.
Toto-Rex can ask what the score means, how it was produced, and whether a person reviewed it.
Under a subject access request, Toto-Rex can also get information such as why the data are used, who receives them, and how long they will be kept.
If Toto-Rex is unhappy with the response, Toto-Rex can complain to the organisation first, then to the ICO.
In the UK, if it was a significant decision made solely by automated means, Toto-Rex can get information about it, make representations, obtain human intervention, and contest it.
If the job had been based in Illinois and AI had analysed the video, the employer should have explained this before the interview.
And under the same Illinois law, Toto-Rex could have asked for the video to be deleted.
If EU GDPR applied, and the score had been part of a decision made solely by automated means with a legal or similarly significant effect, Toto-Rex could ask for the procedure and principles behind it.
Three key terms
Subject access request
A request for a copy of the personal data an organisation holds about you.
For example: asking a company for your interview notes after a rejection.
Personal data
Information that relates to you as an identifiable person.
For example: your CV, your test scores, or notes about your interview.
Representations
Your chance to put your side of the story to the organisation.
In the UK, you can make representations about significant decisions made solely by automated means.
Further reading
Start with the ICO's guide to subject access.
For the law itself, see sections 76 and 80 of the Data (Use and Access) Act 2025.
For rejection and discrimination, see the Acas page on being rejected for a job.
For Illinois, see the Artificial Intelligence Video Interview Act, 820 ILCS 42.
Sources
ICO, A guide to subject access, updated 16 July 2026. UK GDPR, Articles 4(1), 12, 12A, 15, 22A, and 22C. Data (Use and Access) Act 2025, sections 76 and 80. EU GDPR, Article 15.
Acas, 'Being rejected or told not to apply'.
Illinois Artificial Intelligence Video Interview Act, 820 ILCS 42, in force since 1 January 2020. Court of Justice of the European Union, Case C-203/22, Dun & Bradstreet Austria, 27 February 2025.
ICO, AI tools in recruitment: audit outcomes report, November 2024. New York City Local Law 144 of 2021 and 6 RCNY 5-304.