A lawsuit accuses an AI hiring firm of building secret dossiers on job applicants, according to Canadian HR Reporter. The allegation puts fresh legal pressure on the relationship between HR teams and the automated recruitment vendors they now depend on.

The complaint, summarized by the outlet, claims the vendor collected and retained candidate information beyond what the hiring employer authorized or what the candidate was told. The publication did not name the defendant in the available copy. Jurisdiction, statutory basis, class status, and damages all await further reporting.

What the source actually says

The story is thin on its face. The headline names the practice, identifies the defendant class as an AI hiring vendor, and signals exposure under Canadian employment-data rules. Canadian HR Reporter covers the country's HR sector and would not run the item without at least a draft complaint on file. Readers should treat the underlying facts as plaintiff allegations, not findings.

Why the case matters for HR

The file matters less for what it alleges than for the questions it forces onto HR desks. Buyers of AI hiring tools rely on vendors to gather, score, and rank candidates inside platforms the buyer does not fully own. Data processing agreements, consent disclosures, and retention schedules are the contract furniture that keeps the arrangement lawful. A claim of undisclosed dossier-building attacks all three at once.

Canadian privacy law runs through PIPEDA, the federal Personal Information Protection and Electronic Documents Act. It requires organizations to identify the purposes for collection, secure consent, and limit retention to what is necessary. AI hiring vendors operating at scale typically act as third-party processors for employers, which makes the employer's own accountability non-delegable.

That is the real weight of the filing. Even when the vendor misbehaves, the employer that commissioned the work can remain on the hook for downstream privacy failures. HR teams that handed the vendor a candidate list, a job description, or a structured interview guide become data custodians in the regulator's eyes, regardless of how the vendor later used the inputs.

The closest HR analogue

The cleanest comparison is the credit-check or criminal-background-screening vendor: a third party that touches sensitive personal information under contract, with the employer retaining residual liability if the vendor overreaches. HR teams now treat those relationships with documented audit rights, written retention schedules, and breach-notification clauses. AI hiring vendors have historically escaped that level of contractual hygiene because the category is newer, the vendors grow faster, and procurement teams are still building the muscle to evaluate them.

The complaint is a reminder that the same hygiene applies. Buyers should expect, sooner or later, to be asked what their AI hiring vendor knows about the candidate, how long it has known it, and whether the candidate was told. "The vendor keeps it" will not satisfy either the plaintiff or the regulator.

Wait for the full docket.