Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUR
CNIL fines EXTIA €300,000 for failing to respect data subject rights.
The French Data Protection Authority (CNIL) has fined EXTIA, an IT and engineering recruitment firm, €300,000 for failing to adequately process erasure requests from former employees and candidates. The company failed to act on over three-quarters of erasure requests in 2024 and did not properly inform individuals about the actions taken, violating GDPR articles 12 and 17.
AI summary of the linked source. Not reviewed by an editor. How this works
Run EXTIA?
Get an email when a new story names EXTIA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonEXTIA, a French IT recruitment firm, failed to honor over 75% of data erasure requests submitted by former employees and candidates in 2024, directly violating GDPR Articles 12 and 17. The root cause reflects a systemic failure to operationalize data subject rights into business processes, treating compliance as a checkbox rather than an ongoing obligation. This matters because organizations that collect personal data must have clearly defined, tested, and auditable workflows for responding to rights requests within the mandated 30-day window. The €300,000 fine illustrates that supervisory authorities are actively enforcing data subject rights, not just data breach incidents.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.