CNIL (France) - SAN-2026-010
CNIL fines EXTIA €300,000 for GDPR violations related to data erasure requests.
France's CNIL has fined consulting firm EXTIA €300,000 for failing to properly handle data erasure requests and inform data subjects of the outcomes. The violations, related to recruitment activities, included unprocessed requests, delayed responses, and failure to notify individuals, despite EXTIA's arguments about automatic deletion and departmental disorganization.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CNIL?
Get an email when a new story names CNIL, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonFrench consulting firm EXTIA was fined €300,000 by the CNIL for systematically failing to process data subject erasure requests, respond within legal timeframes, and notify individuals of outcomes — all core obligations under GDPR Article 17. The root cause was a combination of poor internal processes, departmental disorganization, and an over-reliance on assumed automatic deletion mechanisms that were never properly verified. This case illustrates that 'we meant to delete it' is not a defensible compliance posture under EU data protection law. Organizations handling personal data in recruitment or HR contexts must treat data subject rights as operational obligations, not administrative afterthoughts. The financial and reputational consequences of ignoring these duties are significant and growing.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.