TL;DR. On May 29, 2026, Magistrate Judge Laurel Beeler (N.D. Cal.) placed the internal bias-testing of Candidate Skills Match under attorney-client privilege in Mobley v. Workday — a case born from more than 100 rejections in 7 years for Derek Mobley. On the US side, the audit is sealed. On the EU side, GDPR Art. 15(1)(h) + 22 and AI Act Annex III + Art. 86 open four concrete levers against your deploying employer.
You applied through a Workday ATS. You got rejected. You want to know why.
Bad news first: since May 29, 2026, Workday's bias audit is officially locked down on the US side.
Better news: you are not a US plaintiff. You are an EU candidate. The rules of the game are different — and they tilt in your favor.
The real question: what can you still pry loose when the audit report itself is shielded by attorney-client privilege?
Mobley v. Workday: what the May 29, 2026 decision actually closed
Set the procedural scene. On May 29, 2026, Magistrate Judge Laurel Beeler (N.D. Cal.) issued a discovery order in Mobley v. Workday. She applied the eight-part Ruehle test to the internal bias-testing of Candidate Skills Match and ruled: covered by attorney-client privilege (McCoy Blog, Josh Gafni, 2026).
The perimeter is narrow. Only the voluntary bias-testing of Candidate Skills Match falls under privilege. Spotlight and Fetch — the two products acquired with HiredScore in 2024 (McCoy, 2026) — are not shielded on the same basis. Spotlight in particular was audited under NYC Local Law 144 in 2023; that audit stays public precisely because the law forced it open.
Context check. Derek Mobley, the lead plaintiff, says Workday's algorithms caused him to be rejected from more than 100 jobs on the platform over seven years because of his age, race and disabilities (CNN Business, Clare Duffy, 2025). On May 16, 2025, Judge Rita Lin granted preliminary certification of an ADEA collective action (Fisher Phillips, Anne Yarovoy Khan, 2025) covering every US applicant aged 40 or over who applied via Workday since September 24, 2020.
Beeler's order has one practical effect: US discovery will not surface the vendor's test datasets, thresholds or disparate-impact metrics. That door is shut.
How attorney-client privilege locks down a bias audit
The mechanism is straightforward. The bias audit is recharacterized as a confidential communication prepared at counsel's request in anticipation of litigation. Privilege attaches; plaintiffs cannot reach it.
For anyone trying to prove algorithmic discrimination, the consequence is brutal. The evidence now sits inside two nested boxes — a technical black box (the scoring model's weights) and a legal one (privilege). Two locks, one door.
But read the next clause carefully. Privilege protects the voluntary. It does not protect the mandatory. Any audit required by law remains outside privilege: NYC Local Law 144 yesterday, FRIA under the AI Act tomorrow, Annex III registries every day in between. Keep that lever in mind — it carries straight into Europe.
- ✓Internal bias-testing of Candidate Skills Match
- ✓Test datasets, thresholds, disparate-impact metrics
- ✓Communications prepared at counsel's request
- ✓Any voluntary audit not required by law
- ✗Spotlight's NYC Local Law 144 audit (2023)
- ✗Any audit mandated by local or federal law
- ✗AI Act Art. 27 FRIA (EU deployers, from 2026)
- ✗Annex III registries and technical documentation
Mobley 2026 vs iTutorGroup 2023: why the EEOC playbook does not re-run
Compare two cases three years apart. September 2023: EEOC v. iTutorGroup. The company agreed to pay $365,000 and signed a consent decree (EEOC, 2023) after programming its tutor application software to automatically reject women aged 55 or older and men aged 60 or older — blocking more than 200 qualified applicants (EEOC, 2023).
The decisive difference: iTutorGroup had a hard-coded rule — "if age ≥ X then reject". Direct evidence, visible the moment anyone opened the application code. No statistical audit needed to prove discrimination.
Mobley 2026 is the inverse. The alleged discrimination is not on a single line of code — it is distributed across the weights of a scoring model. The only way to expose it is the internal bias-testing. The very testing that just landed under privilege.
The blunt lesson: the more sophisticated the hiring AI, the more proof depends on an internal audit — and the more useful attorney-client privilege becomes as a shield for the vendor.
- ✓Hard-coded rule: if age ≥ X then reject
- ✓Direct evidence visible in the application code
- ✓No statistical audit required to prove discrimination
- ✓EEOC settlement: $365,000
- ✓200+ qualified US applicants blocked
- ✗Probabilistic scoring distributed across model weights
- ✗Proof entirely dependent on internal bias-testing
- ✗Internal audit sealed under attorney-client privilege (Ruehle test)
- ✗US discovery blocked by the May 29, 2026 Beeler order
- ✗100+ rejections in 7 years for Derek Mobley
EU lever #1: GDPR Art. 15(1)(h) — aim at the outputs, not the weights
You are not Derek Mobley. You are an EU candidate. You hold a different weapon: GDPR Article 15(1)(h).
What the article covers: "meaningful information about the logic involved, as well as the significance and the envisaged consequences" of automated processing (GDPR Art. 15). Operationally: you can demand the declared input variables, the output score, the employer-side decision thresholds and the trace of the individual decision on your file.
What it does not cover: model weights, source code, the vendor's voluntary bias-testing. Ask for those and you get an instant refusal on trade-secret grounds — and you have burned a round.
The procedural trick: file your DSAR with the EU deploying employer, not with Workday US. DSAR = Data Subject Access Request, your GDPR right to access the personal data held about you. The European employer is the controller under GDPR. US privilege binds a US case; it does not bind a European employer answering to a national data protection authority.
Subject: Subject access request — GDPR Article 15(1)(h) — application [job reference].
Dear Data Protection Officer,
Under Article 15(1)(h) GDPR, I request the meaningful information about the logic involved in the automated processing that led to the rejection of my application: (1) declared input variables passed to the AI system, (2) output score assigned to my file, (3) decision threshold applied on the employer side, (4) trace of the individual decision and its consequences on my file.
Statutory reply window: 30 days, extendable by 2 months for complex requests (Art. 12(3) GDPR). Absent a reply, I will escalate to the national supervisory authority.
EU levers 2 through 4: GDPR Art. 22, AI Act Annex III §4(a), Article 86
Three more weapons, stackable.
Lever 2 — GDPR Article 22. If your rejection is solely automated (auto-knockout on a score with no human in the loop), you have the right "not to be subject to a decision based solely on automated processing" and you can demand human intervention and contest the decision (GDPR Art. 22). This is the textbook lever against silent opaque filtering.
Lever 3 — AI Act Annex III §4(a). This provision classifies as high-risk the "AI systems intended to be used for the recruitment or selection of natural persons, in particular to … analyse and filter job applications, and to evaluate candidates" (AI Act Annex III). Workday Recruiting, Candidate Skills Match, Spotlight and Fetch deployed in the EU all fall inside that box. Classification triggers the Articles 11–15 documentation duties and the Article 27 FRIA obligation for public-sector and certain private deployers.
Lever 4 — AI Act Article 86. Entry into force: August 2, 2026. From that date, any candidate affected by a high-risk Annex III system is entitled to obtain from the deployer "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken" (AI Act Art. 86). Enforceable against the EU deployer — not the US vendor.
Four levers. Four angles of attack. None of them needs the privileged bias-testing — and that is exactly why they keep working.
Candidate playbook: a 90-day sequence
Concretely, here is the sequence.
Day 0 — GDPR Art. 15(1)(h) DSAR. Email to the employer. Target: logic involved, variables, score, thresholds, consequences. Statutory reply window: 30 days, extendable by 2 months for complex requests (GDPR Art. 12(3)).
Day 15 — Activate Art. 22(3). If the employer admits an auto-rejection on score, formally request a documented human review and contest the decision.
Day 30 — Request the FRIA. If the employer is a public body or a critical operator, request access to the Fundamental Rights Impact Assessment under AI Act Art. 27.
Day 60 then Day 90 — Article 86. From August 2, 2026, file a written request for an explanation of the role of the AI system in your decision and the main elements relied on. This is the lever that, in theory, returns the densest qualitative material.
Once the sequence is running, tighten your candidate file in parallel: the strength of your DSAR depends partly on what you documented on your CV side before the application went in.
FAQ
Does the Mobley ruling apply to an EU candidate?
Not procedurally — the order is a US decision. But yes as a strategic signal: you will not get the US bias-testing through discovery. That is exactly what justifies switching immediately to GDPR + AI Act, enforceable against your EU deploying employer.
What did Judge Beeler actually decide on May 29, 2026?
She applied the eight-part Ruehle test to the internal bias-testing of Candidate Skills Match and ruled it covered by attorney-client privilege (McCoy Blog, Josh Gafni, 2026).
Are all three Workday tools shielded?
No. Only the voluntary bias-testing of Candidate Skills Match is. Spotlight and Fetch arrived with the 2024 HiredScore acquisition; Spotlight, audited under NYC Local Law 144 in 2023, stays accessible on that perimeter.
How is this different from iTutorGroup 2023?
iTutorGroup hard-coded the rejection of women 55+ and men 60+: direct evidence, EEOC settlement of $365,000, more than 200 qualified US applicants blocked. Mobley attacks a probabilistic scoring model — only provable via an internal audit, which is now sealed.
Can I demand Workday's model weights under GDPR Art. 15?
No. Art. 15(1)(h) covers the logic involved in a functional sense: variables, score, consequences. Not the code, not the weights (trade secrets).
Is AI Act Article 86 already enforceable in June 2026?
No. Entry into force is August 2, 2026. From that date, every EU deployer of an Annex III §4(a) system — every recruiting ATS — must give a clear and meaningful explanation to a candidate who requests it.
Can my EU employer hide behind US privilege to refuse information?
No. Attorney-client privilege binds US procedure. In the EU, the deploying employer is the controller under GDPR and the deployer of a high-risk AI system under the AI Act, independently of the US vendor.
What if the rejection is not solely automated?
Art. 22 does not apply, but Art. 15(1)(h), AI Act Annex III §4(a) and Art. 86 remain available. High-risk classification alone triggers the Articles 11–15 documentation and the Art. 86 explanation right — only Art. 22 requires full automation.
How long does the employer have to answer a DSAR?
30 days, extendable by 2 months if the request is complex (GDPR Art. 12(3)). Keep the acknowledgement of receipt: silence or a late reply lets you escalate to your national supervisory authority.
Does the Mobley ADEA collective cover EU candidates?
No. The May 16, 2025 certification only covers US applicants aged 40 or over who applied via Workday since September 24, 2020 (Fisher Phillips, 2025).
Key takeaways
- On May 29, 2026, US bias-testing of Candidate Skills Match went under attorney-client privilege: forget Workday-side discovery.
- The iTutorGroup 2023 precedent ($365,000, more than 200 applicants) does not re-run: probabilistic scoring locks the direct-evidence path.
- GDPR Art. 15(1)(h) targets the outputs of the model, never the weights — that is what makes it admissible.
- GDPR Art. 15(1)(h) + Art. 22 + AI Act Annex III §4(a) + Article 86 (August 2, 2026) = four stackable levers on the EU deployer side.
- Always aim at the EU employer, never at Workday US: the employer is the deployer under the AI Act.
- The DSAR → Art. 22 → FRIA → Art. 86 sequence fits inside 90 days.
- Privilege shields the voluntary audit, never the regulatory one: NYC LL 144, FRIA, Annex III registries stay open.
When the ATS has already filtered you out without an explanation, simulate the interview you never got to prepare what comes next — while your DSAR sequence runs in parallel.
