AI Data Protection for Staffing and HR: The Disposal Rule Meets a Prompt You Cannot Recall

16 CFR 682.3(a) requires any person who maintains or otherwise possesses consumer information for a business purpose to "properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal." Paragraph (b)(2) names the electronic example: destruction or erasure so the information "cannot practicably be read or reconstructed." A recruiter pasting a background check summary into a chat product to draft a rejection letter has created a copy on infrastructure the staffing firm cannot erase, cannot inventory and did not record. Disposal is the duty that breaks first in ai data protection staffing and hr, because disposal presumes you know where the copies are.

I want to work through which duties model usage strains, why the recruiting stack misses the traffic entirely, and what the per-request record has to hold when an FTC inquiry or a candidate's counsel asks.

TL;DR

• The Disposal Rule reaches any record about an individual that is a consumer report or derived from one, in paper, electronic or other form, under 16 CFR 682.1(b).
• Erasure has to leave the information unable to be read or reconstructed, which is impossible for a copy held by a third party you never inventoried.
• Service providers who hold consumer information through services provided to a covered firm carry their own duty under 682.3(b)(4).
• For firms already under the Safeguards Rule, 682.3(b)(5) folds disposal into the written information security programme, so a gap here is a Safeguards gap too.

What counts as consumer information

The scope is wider than most recruiting teams assume, and the definition does the work.

16 CFR 682.1(b) defines consumer information as "any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report," and adds that "consumer information also means a compilation of such records." Information that does not identify individuals, such as aggregate information or blind data, sits outside.

Two consequences follow. A summary a recruiter typed from a background check report is derived from a consumer report, so it is consumer information even though it is not the report. And a spreadsheet of candidate names with adjudication outcomes is a compilation, which means the aggregation itself is covered rather than only the underlying rows.

The disposal definition in 682.1(c) covers discarding or abandonment. A copy sitting on a third party's infrastructure with no owner, no retention policy on your side and no record of its existence is abandonment in the ordinary sense of the word.

The duty that model usage breaks

Most data protection rules ask you to control access. The Disposal Rule asks you to control endings, and endings require an inventory.

A staffing firm can describe its disposal programme today with reasonable confidence. Applicant tracking records age out on a schedule. Paper files get shredded. Background check reports from the consumer reporting agency have a retention period and a deletion job. The programme works because every location is known.

A prompt breaks the inventory rather than the shredder. The firm still shreds correctly and still runs the deletion job, and there is now a copy outside the map. No reasonable measure can be taken against a copy whose existence nobody recorded, and the failure shows up as an absence in the programme rather than as an incident anyone notices.

My opinion is that this is the most under-appreciated compliance problem in recruiting AI adoption, because the conversation has fixated on bias in screening while the boring records duty quietly stopped being satisfiable. Bias in automated decisions is a real and separate issue. Disposal is the one that fails on day one with no adverse outcome required.

Why the recruiting stack misses it

A staffing firm's applicant tracking system is usually well instrumented. Access is role-based, adjudication decisions are logged, the consumer reporting agency integration is audited, and the adverse action workflow leaves a trail.

None of that instrumentation sits on the path between a recruiter's browser and a model provider. The request leaves as ordinary TLS. A data loss prevention tool tuned for social security numbers may catch a raw identifier and will pass a paragraph naming a candidate, a former employer, a conviction and a date without comment, because prose about a person's history matches no pattern it holds. The general gap between pattern matching and content classification is covered in AI DLP and traditional DLP.

The agentic pattern widens it. Firms now run services that screen resumes, draft candidate summaries and generate outreach. Those services read consumer information by design and call models on shared service credentials, so the record names a service account and never the recruiter or the requisition. Redaction on the outbound path is one mechanism for narrowing what leaves, covered in PII redaction in LLM traffic.

What the record has to carry

The record that answers an inquiry gets written when the request leaves the authenticated user, before any response comes back.

Per request, the useful content covers the timestamp, the recruiter authenticated through the firm's identity provider, that person's role and client assignment, the calling application or agent, the destination provider with model name and version, the classification applied to the request body, whether the content held consumer information, the policy version in force, the enforcement outcome, and a hash of request and response.

The candidate axis carries the weight. A candidate's counsel or an FTC inquiry asks about a named individual, so retrieval by candidate identifier, by requisition, by recruiter or by time range is what makes the record usable. A record keyed only to employee and timestamp cannot answer a question framed around a person.

Two structural points. Storage has to sit outside the reach of the applicant tracking system, because the people being recorded operate it. And the record is what converts an unmapped copy into a mapped one: a request you recorded is a location you know about, which is the precondition for any disposal measure at all.

Coverage is the property that makes the control real

A disposal programme is only as good as its inventory, so an AI control that covers most of the traffic covers none of the problem.

An enforcement point on the egress path can refuse requests carrying consumer information, or route them to an internal model where the copy stays inside the firm's own retention regime and its own deletion jobs. Both outcomes are recorded. A refusal shows the control operated. A reroute keeps the copy inside the map, which means the existing disposal programme still reaches it without modification.

The requirement is exhaustiveness. A path around the enforcement point is a path that produces unmapped copies, which is the original problem with a control document attached. The argument for enforcing at the request boundary instead of in policy is in why AI security must be inline.

DeepInspect

DeepInspect is a stateless proxy between authenticated users or agents and any LLM endpoint. Identity resolution, classification of the request body, model routing and policy enforcement run inline on the HTTP request before it reaches the provider, which puts an enforcement point in front of exactly the traffic the Disposal Rule cares about.

Each decision writes a signed record carrying the authenticated recruiter, the role and client context, the classification applied, the destination model and version, the policy version in force, the outcome and the timestamp. Records commit to append-only storage before the response returns, retention configures to match the firm's own consumer information schedule, and retrieval by person, candidate, requisition, model version or time range completes in seconds. The boundary covers authenticated HTTP traffic between your people or agents and the models they call. Adverse action notices, permissible purpose determinations, the consumer reporting agency relationship and the written disposal programme stay with the people who own them today.

If your recruiters are drafting candidate summaries in a chat tab, your disposal inventory has holes in it that no shredding schedule reaches. Book a demo today.