Dear Sir/Madam,

I am writing to express serious concerns regarding the use of facial analysis technology by Neurolytics (KVK 72043776), which is being employed in recruitment processes by companies in the Netherlands, including bunq B.V. (KVK 54992060)

### Nature of Concern

I wish to report what I believe to be unlawful processing of personal data (specifically biometric data) in violation of the General Data Protection Regulation (GDPR). Based on documentation from bunq's recruitment privacy policy and Neurolytics' own descriptions, job applicants are required to undergo facial scanning during the recruitment process in ways that raise significant privacy concerns:

1. Collection of Biometric Data: Neurolytics records candidates' facial expressions while they watch company videos and during cognitive assessments, analyzing "behavioral qualities" and "engagement levels."

2. Questionable Consent Mechanism: Given the power imbalance in recruitment, candidates may feel unable to meaningfully refuse this invasive data collection without losing job opportunities.

3. Processing of Special Category Data: Facial analysis that infers emotional states or personality traits likely constitutes processing of biometric data, which is a special category under GDPR Article 9 requiring explicit consent and strong justification.

4. Lack of Transparency: While recording is disclosed, the specific algorithmic judgments being made about candidates based on their facial expressions remain opaque.

5. Questionable Scientific Validity: The claim that facial analysis can accurately measure "engagement" or determine personality traits lacks robust scientific support, raising questions about the necessity and proportionality of this data collection.

### Evidence

I am including the following evidence (attached below are archive links detailing these):

1. Text from bunq's Recruitment Privacy Policy (Section 4) which states: "Additionally, we use third party platforms, TestGorilla and Neurolytics for skills, personality, and aptitude assessments, but only with your consent."

2. Descriptions from Neurolytics' applicant-facing materials stating: "As you're watching the video, your webcam is recording. Our smart technology can analyze your behavioral qualities to measure your engagement levels with the various messages in the video." And: "As you're taking the questionnaire, you're being recorded. The scores of this questionnaire, will tell the recruiter more about your stress resilience and your ease under pressure."

### Legal Basis for Complaint

I believe these practices may violate several GDPR principles:

* Data Minimization: The collection of facial data appears excessive relative to the purpose of recruitment.
* Lawfulness and Fairness: The power imbalance in recruitment raises questions about whether consent can be freely given.
* Special Category Data: Biometric data processing requires explicit consent and stronger justifications.
* Automated Decision-Making: The process appears to involve profiling with significant effects on individuals.

### Request for Investigation

I respectfully request that the Dutch DPA investigate:

1. Whether the collection of facial reaction data during recruitment is proportionate and necessary
2. Whether valid consent can be obtained in this context given the power imbalance
3. Whether the scientific validity of the claims made by Neurolytics is sufficient to justify this level of data collection
4. Whether the practices comply with GDPR requirements for processing biometric data

This technology represents a concerning development in recruitment practices that could normalize intrusive surveillance in employment contexts if left unchecked.

Thank you for your attention to this matter. I am available to provide any further information that may assist in your investigation.

Sincerely,

[REDACTED]

Attachments:
1. https://web.archive.org/web/20250330160732/https://careers.bunq.com/recruitment-privacy-policy
2. https://web.archive.org/web/20250330160416/https://neurolytics.ai/en/what-to-expect-2/