[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ferUetUw9_j4yZVNo-DtBD_3mV2ZiMwMdTFI4rJFA6ws":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":81},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"3200f418-cb3c-4a5b-92d2-d830aca6dd90","CNIL (France) - SAN-2026-010","cnil-france-san-2026-010-70ce6e","Created page with \"{{DPAdecisionBOX |Jurisdiction=France |DPA-BG-Color= |DPAlogo=LogoFR.png |DPA_Abbrevation=CNIL |DPA_With_Country=CNIL (France) |Case_Number_Name=SAN-2026-010 |ECLI= |Original_Source_Name_1=CNIL |Original_Source_Link_1=https:\u002F\u002Fwww.legifrance.gouv.fr\u002Fcnil\u002Fid\u002FCNILTEXT000054810440?fonds=CNIL&page=1&pageSize=10&query=2016%2F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT |Original_Source_Language_1=French |Original...\" Show changes","France's CNIL has fined consulting firm EXTIA €300,000 for failing to properly handle data erasure requests and inform data subjects of the outcomes. The company received numerous complaints regarding difficulties in exercising data subject rights, leading to an on-site inspection. The investigation revealed that a significant portion of erasure requests were not processed, data subjects were not informed of the outcomes, and responses were often delayed, violating Articles 12 and 17 of the GDPR.","CNIL fines EXTIA €300,000 for GDPR violations related to data erasure requests.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CNIL_(France)_-_SAN-2026-010&diff=53187&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fthumb\u002F0\u002F0f\u002FLogoFR.png\u002F1200px-LogoFR.png","2026-09-24T13:07:36+00:00","2026-09-24T14:00:44.645874+00:00",7,[17,20,23],{"name":18,"type":19},"CNIL","vendor",{"name":21,"type":22},"GDPR","product",{"name":24,"type":19},"EXTIA","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,35,40,42],{"category":32},{"id":33,"icon":27,"name":21,"slug":34},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":36},{"id":37,"icon":27,"name":38,"slug":39},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":41},{"id":25,"icon":27,"name":28,"slug":29},{"category":43},{"id":44,"icon":27,"name":45,"slug":46},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,24,21],{"controls":50,"vendors":80},[51],{"slug":52,"name":53,"problem":54,"products":55},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",[],{"slug":82,"title":83,"body":84,"framework_refs":85,"framework_notes":94},"extia-fined-300k-for-failing-to-honor-gdpr-erasure-requests","EXTIA Fined €300K for Failing to Honor GDPR Erasure Requests","French consulting firm EXTIA was fined €300,000 by CNIL for systematically failing to process data subject erasure requests and neglecting to inform individuals of outcomes, violating GDPR Articles 12 and 17. The root cause reflects a lack of mature internal processes and accountability for managing data subject rights, a critical operational obligation under GDPR. This matters because organizations handling personal data must treat rights requests as a formal, time-bound compliance workflow—not an ad hoc administrative task. Failure to do so exposes companies to significant regulatory penalties, reputational damage, and erosion of public trust in data handling practices.",[86,87,88,89,90,91,92,93],"GDPR Article 12 – Transparent information and communication","GDPR Article 17 – Right to erasure ('right to be forgotten')","GDPR Article 5(1)(f) – Integrity and confidentiality","NIST SP 800-53 IP-3 – Information Management and Retention","NIST Privacy Framework: Respond-RS.CM-P1","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management (PIMS)","ITIL Service Management – Request Fulfilment Process",{"CIS Control 3 – Data Protection":95,"NIST Privacy Framework: Respond-RS.CM-P1":96,"GDPR Article 5(1)(f) – Integrity and confidentiality":97,"ITIL Service Management – Request Fulfilment Process":98,"ISO\u002FIEC 27701 – Privacy Information Management (PIMS)":99,"NIST SP 800-53 IP-3 – Information Management and Retention":100,"GDPR Article 12 – Transparent information and communication":101,"GDPR Article 17 – Right to erasure ('right to be forgotten')":102},"Data protection includes knowing where personal data is stored so it can be found and erased when a request arrives.","A defined response process for privacy requests ensures they are tracked and answered, which EXTIA lacked.","Retaining data that should have been erased undermines confidentiality and integrity obligations, keeping personal data exposed longer than necessary.","Treating erasure requests as a tracked fulfilment process with deadlines would prevent them from being ignored.","A privacy information management system assigns clear responsibility for rights requests, addressing the accountability gap behind EXTIA's failures.","Information management and retention rules ensure data is deleted when required, supporting erasure requests rather than leaving data indefinitely.","Article 12 requires timely responses to rights requests and informing individuals of the outcome, which EXTIA failed to do.","Article 17 gives individuals the right to erasure, and EXTIA was fined for systematically failing to act on these requests."]