[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLY7ozX8l6plPB_ZmNFYb__6JEuyuTzyycA10ryE7eQs":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"94b1ebe1-8823-4b38-b7e6-1cb17fe27072","CNIL (France) - SAN-2026-010","cnil-france-san-2026-010-02682f","← Older revision Revision as of 13:09, 29 September 2026 Line 92: Line 92: }} }} The DPA fined consulting firm EXTIA €300,000 for failing to properly handle erasure requests and to inform data subjects of the outcome of their requests in accordance with Articles 12 and 17 GDPR. The DPA fined consulting firm EXTIA €300,000 for failing to properly handle erasure requests and to inform data subjects of the outcome of their requests in accordance with [[Article 12 GDPR|Articles 12]] and [[Article 17 GDPR|17 GDPR]]. == English Summary == == English Summary == Line 105: Line 105: In particular, the investigation identified requests that had not been processed, requests for which data subjects had not been informed of the outcome, and requests to which the controller had responded after the applicable deadline. The controller argued that many of the requests concerned unsuccessful applicants whose personal data had already been automatically deleted 60 days after their applications were received. It also attributed the shortcomings to the temporary disorganisation of its legal department and a substantial increase in erasure requests. In particular, the investigation identified requests that had not been processed, requests for which data subjects had not been informed of the outcome, and requests to which the controller had responded after the applicable deadline. The controller argued that many of the requests concerned unsuccessful applicants whose personal data had already been automatically deleted 60 days after their applications were received. It also attributed the shortcomings to the temporary disorganisation of its legal department and a substantial increase in erasure requests. The DPA initiated sanction proceedings against the controller for alleged infringements of Articles 12, 13 and 17 GDPR. During the proceedings, the controller submitted additional evidence of the deletion of personal data and the measures taken to inform the affected data subjects. The DPA initiated sanction proceedings against the controller for alleged infringements of [[Article 12 GDPR|Articles 12]], [[Article 13 GDPR|13]] and [[Article 17 GDPR|17 GDPR]]. During the proceedings, the controller submitted additional evidence of the deletion of personal data and the measures taken to inform the affected data subjects. === Holding === === Holding === The DPA found that the controller infringed Articles 12 and 17 GDPR by failing to properly handle erasure requests and inform data subjects of the outcome of their requests. The DPA found that the controller infringed [[Article 12 GDPR|Articles 12]] and [[Article 17 GDPR|17 GDPR]] by failing to properly handle erasure requests and inform data subjects of the outcome of their requests. First, the DPA established that the controller had failed to process 12 erasure requests in violation of Articles 12 and 17 GDPR. Although the controller argued that many applicants' personal data had already been automatically deleted after 60 days, the DPA found that this did not exempt it from its obligations regarding the exercise of data subject rights. First, the DPA established that the controller had failed to process 12 erasure requests in violation of [[Article 12 GDPR|Articles 12]] and [[Article 17 GDPR|17 GDPR]]. Although the controller argued that many applicants' personal data had already been automatically deleted after 60 days, the DPA found that this did not exempt it from its obligations regarding the exercise of data subject rights. Second, the DPA found an infringement of [[Article 12 GDPR|Article 12 GDPR]] because 166 data subjects had not been informed of the outcome of their erasure requests. The DPA recalled that controllers must inform data subjects of the measures taken in response to their requests, regardless of whether their personal data has already been erased or can lawfully be retained. Second, the DPA found an infringement of [[Article 12 GDPR]] because 166 data subjects had not been informed of the outcome of their erasure requests. The DPA recalled that controllers must inform data subjects of the measures taken in response to their requests, regardless of whether their personal data has already been erased or can lawfully be retained. Third, the DPA found a further infringement of [[Article 12 GDPR|Article 12 GDPR]] because the controller had responded late to 26 erasure requests and one access request. The DPA emphasised that controllers must respond within one month unless a justified extension is communicated to the data subject within that period. Third, the DPA found a further infringement of [[Article 12 GDPR]] because the controller had responded late to 26 erasure requests and one access request. The DPA emphasised that controllers must respond within one month unless a justified extension is communicated to the data subject within that period. In total, 204 erasure requests received in 2024 had not been properly handled, representing more than three-quarters of the requests received that year. The alleged infringement of [[Article 13 GDPR|Article 13 GDPR]] concerning information provided to employees was withdrawn and was not established. In total, 204 erasure requests received in 2024 had not been properly handled, representing more than three-quarters of the requests received that year. The alleged infringement of [[Article 13 GDPR]] concerning information provided to employees was withdrawn and was not established. The DPA imposed a €300,000 administrative fine, taking into account the number of affected data subjects, the controller's negligence and its failure to comply with its obligations despite two previous formal notices. Although the controller had subsequently implemented corrective measures, these did not remove its responsibility for the infringements. The DPA imposed a €300,000 administrative fine, taking into account the number of affected data subjects, the controller's negligence and its failure to comply with its obligations despite two previous formal notices. Although the controller had subsequently implemented corrective measures, these did not remove its responsibility for the infringements.","France's CNIL (National Data Protection Authority) issued a €300,000 administrative fine against consulting firm EXTIA for systematic failures in handling data subject erasure requests and providing outcome notifications. The investigation found that 204 erasure requests (75% of 2024 requests) were improperly handled: 12 were not processed, 166 data subjects were not informed of outcomes, and 26 requests received late responses. Despite the company's claims of automatic deletion and departmental disorganization, the DPA determined these failures violated Articles 12 and 17 GDPR, especially after two previous formal notices.","CNIL fines consulting firm EXTIA €300,000 for failing to handle erasure requests and inform data subjects under GDPR","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CNIL_(France)_-_SAN-2026-010&diff=53210&oldid=53188","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fthumb\u002F0\u002F0f\u002FLogoFR.png\u002F1200px-LogoFR.png","2026-09-29T13:09:11+00:00","2026-09-29T14:00:24.398279+00:00",7,[17,20],{"name":18,"type":19},"EXTIA","vendor",{"name":21,"type":19},"CNIL","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":22,"icon":24,"name":25,"slug":26},null,"GDPR","gdpr",[28,33,38],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":39},{"id":40,"icon":24,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":62},"300k-gdpr-fine-for-mishandling-75-of-erasure-requests","€300K GDPR Fine for Mishandling 75% of Erasure Requests","EXTIA's systematic failure to process, acknowledge, and respond to data subject erasure requests demonstrates a critical breakdown in GDPR operational compliance, not just policy awareness. Of 272 total erasure requests, 204 were mishandled — either ignored, responded to late, or completed without notifying the requestor — violating both the right to erasure (Article 17) and communication obligations (Article 12). The severity of the fine was compounded by the fact that CNIL had already issued two prior formal notices, meaning EXTIA had repeated opportunities to remediate and failed to do so. This case highlights that vague claims of 'automatic deletion' or internal disorganization are not acceptable defenses under GDPR, and that regulators will escalate enforcement against repeat offenders. Organizations must treat data subject rights as operational processes requiring tracking, accountability, and audit trails — not informal workflows.",[53,54,55,56,57,58,59,60,61],"GDPR Article 12 – Transparent information and communication","GDPR Article 17 – Right to erasure ('right to be forgotten')","GDPR Article 5(1)(f) – Integrity and confidentiality principle","NIST SP 800-53 IP-1 (Individual Access)","NIST SP 800-53 AU-3 (Content of Audit Records)","CIS Control 3 – Data Protection","CIS Control 17 – Incident Response Management","ISO\u002FIEC 27001 Annex A 5.34 – Privacy and protection of personally identifiable information","ITIL Service Management – Request Fulfilment Process",{}]