[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fU5EyoP1-Sq_9XZKsy6i1veqe6JQYlD8rMKewrGG0vDc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"8832667f-d717-44bb-8324-814d912d310a","extia-fined-300k-for-failing-to-honor-gdpr-data-erasure-requests","e6b5b208-8cb9-4694-9a96-39c43f305af3","EXTIA Fined €300K for Failing to Honor GDPR Data Erasure Requests","French consulting firm EXTIA was fined €300,000 by the CNIL for systematically failing to process data subject erasure requests, respond within legal timeframes, and notify individuals of outcomes — all core obligations under GDPR Article 17. The root cause was a combination of poor internal processes, departmental disorganization, and an over-reliance on assumed automatic deletion mechanisms that were never properly verified. This case illustrates that 'we meant to delete it' is not a defensible compliance posture under EU data protection law. Organizations handling personal data in recruitment or HR contexts must treat data subject rights as operational obligations, not administrative afterthoughts. The financial and reputational consequences of ignoring these duties are significant and growing.","**Immediate actions:**\n- Establish a centralized Data Subject Rights (DSR) intake and tracking system to ensure no erasure, access, or rectification request goes unlogged.\n- Audit all existing unprocessed or overdue data subject requests and respond within GDPR's one-month deadline.\n- Verify that any claimed 'automatic deletion' mechanisms are actually functioning and document evidence of their operation.\n\n**Long-term improvements:**\n- Implement a formal DSR workflow with assigned ownership, escalation paths, and SLA-based alerting for approaching deadlines.\n- Conduct regular data mapping exercises to identify where personal data (especially recruitment data) is stored, duplicated, or retained beyond necessity.\n- Embed GDPR rights-handling procedures into HR and recruitment department onboarding and annual training programs.\n\n**Detection & monitoring measures:**\n- Deploy dashboards or ticketing system reports that surface open DSR requests nearing or exceeding the 30-day response window.\n- Schedule quarterly internal audits of DSR compliance rates and escalate failures to DPO and senior management.\n- Maintain immutable logs of all DSR requests received, actions taken, and notifications sent to data subjects as evidence of compliance.",[12,13,14,15,16,17,18,19,20],"GDPR Article 17 – Right to Erasure ('Right to be Forgotten')","GDPR Article 12 – Transparent Information and Communication (response timelines)","GDPR Article 5(1)(e) – Storage Limitation Principle","GDPR Article 24 – Responsibility of the Controller","NIST SP 800-53 IP-3 (Information Management and Retention)","NIST Privacy Framework PR.DS-P4 (Data Retention and Disposal)","CIS Control 3 – Data Protection (Data Retention and Disposal)","ISO\u002FIEC 27701:2019 – Section 7.3.4 (Obligations to Data Subjects)","ITIL Service Management – Request Fulfilment Process",{},"published","2026-09-29T16:21:21.70567+00:00","2026-09-29T16:21:21.431+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CNIL_(France)_-_SAN-2026-010&diff=53225&oldid=53210","cnil-france-san-2026-010-fd7a66","CNIL (France) - SAN-2026-010",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[44,48],{"slug":45,"name":46,"problem":47},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":49,"name":50,"problem":51},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]