€300K GDPR Fine for Mishandling 75% of Erasure Requests
Written by AI from the linked story. Not reviewed by an editor. How this works
EXTIA's systematic failure to process, acknowledge, and respond to data subject erasure requests demonstrates a critical breakdown in GDPR operational compliance, not just policy awareness. Of 272 total erasure requests, 204 were mishandled — either ignored, responded to late, or completed without notifying the requestor — violating both the right to erasure (Article 17) and communication obligations (Article 12). The severity of the fine was compounded by the fact that CNIL had already issued two prior formal notices, meaning EXTIA had repeated opportunities to remediate and failed to do so. This case highlights that vague claims of 'automatic deletion' or internal disorganization are not acceptable defenses under GDPR, and that regulators will escalate enforcement against repeat offenders. Organizations must treat data subject rights as operational processes requiring tracking, accountability, and audit trails — not informal workflows.
Tactical Insight
Immediate actions
- Implement a centralized Data Subject Rights (DSR) management system to log, track, and assign every incoming erasure request with deadlines.
- Conduct an immediate audit of all open and historical erasure requests to identify unprocessed, late, or uncommunicated responses.
Process & Governance improvements
- Establish a formal DSR workflow with mandatory notification steps, escalation triggers, and outcome confirmations sent to data subjects within GDPR's one-month window.
- Assign a dedicated Data Protection Officer (DPO) or compliance owner with authority to enforce cross-departmental adherence to erasure procedures.
- Define SLAs for each stage of the erasure lifecycle (receipt, processing, deletion confirmation, subject notification) and review compliance monthly.
Detection & Monitoring measures
- Configure automated alerts for DSR tickets approaching the 30-day legal deadline to prevent late responses.
- Maintain an immutable audit log of all DSR actions (received, processed, notified, rejected) to support DPA investigations and internal reviews.