[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwNzxq3R3KuEyHC7DuJeRioDQ1_w5Q7lvxYr81gfsiKI":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":64},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":26},"14d62c14-248a-4d0a-ac41-ee3f2a59fb8e","Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUR","failure-to-respect-the-rights-of-individuals-the-cnil-fined-extia-300-000-eur-87cb96","Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUR ikerinar Fri, 11\u002F09\u002F2026 - 09:24","The French Data Protection Authority (CNIL) has fined EXTIA, an IT and engineering recruitment firm, €300,000 for failing to adequately process erasure requests from former employees and candidates. The company failed to act on over three-quarters of erasure requests in 2024 and did not properly inform individuals about the actions taken, violating GDPR articles 12 and 17.","CNIL fines EXTIA €300,000 for failing to respect data subject rights.","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Ffailure-to-respect-the-rights-of-individuals-the-cnil-fined-extia-300-000-eur_en",null,"2026-09-11T07:24:23+00:00","2026-09-11T08:00:25.276243+00:00",7,[17,20],{"name":18,"type":19},"EXTIA","vendor",{"name":21,"type":19},"CNIL","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":22,"icon":12,"name":24,"slug":25},"Policy","policy",[27,32,37],{"category":28},{"id":29,"icon":12,"name":30,"slug":31},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":33},{"id":34,"icon":12,"name":35,"slug":36},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":45,"vendors":63},[46],{"slug":47,"name":48,"problem":49,"products":50},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[51,57],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":52,"product_name":53,"url":55,"description":56},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":58,"product_name":59,"url":61,"description":62},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":65,"title":66,"body":67,"framework_refs":68,"framework_notes":78},"extia-fined-300k-for-ignoring-gdpr-erasure-requests","EXTIA Fined €300K for Ignoring GDPR Erasure Requests","EXTIA, a French IT recruitment firm, failed to honor over 75% of data erasure requests submitted by former employees and candidates in 2024, directly violating GDPR Articles 12 and 17. The root cause reflects a systemic failure to operationalize data subject rights into business processes, treating compliance as a checkbox rather than an ongoing obligation. This matters because organizations that collect personal data must have clearly defined, tested, and auditable workflows for responding to rights requests within the mandated 30-day window. The €300,000 fine illustrates that supervisory authorities are actively enforcing data subject rights, not just data breach incidents.",[69,70,71,72,73,74,75,76,77],"GDPR Article 12 – Transparent information and communication","GDPR Article 17 – Right to erasure ('right to be forgotten')","GDPR Article 5(1)(e) – Storage limitation principle","GDPR Article 24 – Responsibility of the controller","NIST Privacy Framework PR.DS-P4 – Data processing management","NIST SP 800-53 IP-1 – Individual Access","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Management – Request Fulfilment Practice",{}]