BACKGROUND
In February 2023, a disabled 40 year old African American job applicant named Derek Mobley, filed a discrimination lawsuit against Human Resources (HR) software vendor Workday, Inc. in the Northern District of California. Mobley alleged that Workday's automated resume-screening tools rejected his applications for more than 80 roles, discriminating against him on the basis of race, age and disability. Although the court initially dismissed the case in January 2024 for failing to show that Workday was an "employment agency," Mobley filed an action in court in February 2024, emphasizing that Workday's system could evaluate resumes without human oversight and make recommendations that effectively determine who advances to interview.
In April 2024, the U.S. Equal Employment Opportunity Commission (EEOC) filed an amicus brief supporting the plaintiff, arguing that Artificial Intelligence (AI)-driven hiring tools may allow employers to exclude protected groups even without explicit intent. A month later, a federal judge allowed the case to proceed, holding that Workday's software participates in the decision-making process by recommending which candidates should move forward and which should be rejected, thereby acting as an "agent" of the employer. By mid-2025, the case had been certified as a collective action on behalf of applicants aged 40 and over, and the judge ordered Workday to identify customers using certain AI features. The litigation raises novel questions about whether technology vendors can be directly liable for discriminatory outcomes and has intensified scrutiny of algorithmic bias in hiring.
Relevance to Nigeria's Data Protection and Employment Landscape
While Mobley v. Workday arises under U.S. anti-discrimination statutes, its implications resonate globally, including in Nigeria. With the proliferation of technology in all sectors of the economy, Nigerian employers increasingly rely on automated screening tools to sift through large volumes of job applications. At the same time, Nigeria's legal regime is evolving to address data privacy, algorithmic fairness and non-discrimination.
Automated Decision-Making Under the NDPA
The Nigeria Data Protection Act 2023 (NDPA) grants individuals a right "not to be subject to a decision based solely on automated processing".1 Employers or third-party vendors that use AI to filter or rank candidates must therefore ensure that human judgment is incorporated into hiring decisions. They should also be prepared to provide information about the logic involved, as data subjects are entitled to an explanation of automated decisions. The NDPA's requirement to implement "appropriate technical and organisational measures" for data security extends to algorithmic systems: operators must assess and mitigate risks of bias, discrimination or unfairness arising from AI tools.
Data Protection Impact Assessments and Vendor Due Diligence
Under the NDPA and the General Application and Implementation Directive 2025 (GAID), Data Controllers of Major Importance2 must conduct Data Protection Impact Assessments (DPIAs)3 for high-risk processing and ensure that third-party processors adhere to NDPA standards. AI-driven hiring tools should be considered high-risk because they involve sensitive personal data (e.g., disability, race, political beliefs etc.) and can significantly affect individuals' employment opportunities. Employers must therefore assess whether a vendor's algorithm uses proxies that might reveal protected characteristics, evaluate the fairness of training data, and implement ongoing audits to detect disparate impact.
The Mobley case underscores and resonates the school of thought and the ensuing regulations that relying on vendor assurances without scrutiny is insufficient. In July 2024, the U.S. judge noted that Workday's software was not simply executing employers' instructions but was making decisions about which candidates progressed. For Nigerian organisations, the Mobley case highlights the need to review contracts with HR technology vendors and ensure that the vendor's tools can be configured to avoid unlawful discrimination. Controllers remain liable for processors' actions under the NDPA; therefore, due diligence and contractual safeguards are critical.
Non-Discrimination and Equal Opportunity
Although Nigeria lacks a comprehensive employment anti-discrimination law equivalent to the U.S. Civil Rights Act or Age Discrimination in Employment Act, various laws prohibit discrimination on grounds such as gender, disability and ethnicity. The Constitution guarantees equality and freedom from discrimination, and other legislation such as the Discrimination against Persons with Disabilities (Prohibition) Act 2018 which prohibits discrimination against persons with disabilities. The Lagos State Special Peoples Law 2011, which only applies in Lagos State, also prohibits discrimination4 on the basis of an employee's disability. The principles in Mobley namely, that AI tools can produce biased outcomes even without intent and that vendors may share responsibility provide a cautionary tale for Nigerian employers. Implementing AI in recruitment should be accompanied by antidiscrimination policies, training, and human oversight.
Lessons and Best Practices for Nigerian Organizations
- Conduct comprehensive DPIAs. Before deploying AI recruitment tools, assess their potential impact on privacy and fairness. Identify whether the algorithm relies on proxies that may indirectly reveal sensitive traits and evaluate the risk of disparate impact.
- Ensure human oversight. Avoid decisions based solely on automated processing. Implement review processes where human decision-makers validate AI recommendations and document the rationale for hiring or rejection.
- Demand transparency from vendors. Require AI vendors to disclose how their models are trained, the data sources used, and measures taken to mitigate bias. Contracts should include audit rights and obligations to assist with NDPA compliance.
- Review and update policies. Update recruitment and data-protection policies to reflect NDPA and GAID requirements. Provide applicants with clear recruitment privacy notices describing automated decision-making, data-subject rights and avenues for appeal.
- Train HR personnel. Ensure that HR professionals understand both discrimination laws, data-protection obligations and are AI literate. This will ensure that they are able to recognize bias in AI outputs, handling data-subject requests and manage data breaches.
- Monitor regulatory developments. The NDPC may issue additional guidance on AI and automated decision-making. Companies should monitor enforcement trends both locally and internationally, as in Mobley to anticipate regulatory expectations.
Conclusion
The Mobley v. Workday litigation is a landmark case that highlights the legal and ethical challenges posed by AI-powered recruitment tools. For Nigerian organisations, the case offers valuable lessons: AI systems can inadvertently discriminate, vendors may share liability for discriminatory outcomes, and regulators are increasingly willing to scrutinise automated decision-making. By aligning practices with the NDPA, GAID and constitutional non-discrimination principles—conducting DPIAs, demanding transparency, and ensuring human oversight—Nigerian employers can harness AI's efficiencies while safeguarding the rights and dignity of job applicants.
Footnotes
1. Section 37(1) of the NDPA 2023
2. An entity which is domiciled, resident in, or operating in Nigeria and processes or intends to process personal data of more than such number of data subjects who are within Nigeria, as the Commission may prescribe, or such other class of data controller or data processor that is processing personal data of particular value or significance to the economy, society or security of Nigeria as the Commission may designate
3. Section 28 of the NDPA 2023 and Article 28 of the GAID 2025
4. Section 42 of the Constitution of the Federal Republic of Nigeria (as amended) 1999
Originally published August 12, 2025
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
