[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOAuA6BBjX6W7cBoBoZdPsi0SVtKAi4IfOnMVZgLbg2E":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"35242301-b2ba-4d13-89b1-db392fccfa34","extia-fined-300k-for-ignoring-gdpr-erasure-requests","14d62c14-248a-4d0a-ac41-ee3f2a59fb8e","EXTIA Fined €300K for Ignoring GDPR Erasure Requests","EXTIA, a French IT recruitment firm, failed to honor over 75% of data erasure requests submitted by former employees and candidates in 2024, directly violating GDPR Articles 12 and 17. The root cause reflects a systemic failure to operationalize data subject rights into business processes, treating compliance as a checkbox rather than an ongoing obligation. This matters because organizations that collect personal data must have clearly defined, tested, and auditable workflows for responding to rights requests within the mandated 30-day window. The €300,000 fine illustrates that supervisory authorities are actively enforcing data subject rights, not just data breach incidents.","**Immediate actions:**\n- Audit all pending and historical data subject requests (DSARs) to identify and remediate any backlog of unanswered erasure requests.\n- Designate a responsible owner (DPO or privacy team member) to triage, track, and acknowledge every incoming GDPR rights request within 72 hours.\n\n**Process & Governance improvements:**\n- Implement a dedicated DSAR management platform or ticketing workflow that enforces SLA tracking and automated deadline alerts for the 30-day response window.\n- Document a formal Data Subject Rights procedure covering erasure, access, portability, and rectification, and review it annually.\n- Train HR, recruitment, and IT staff on how to recognize, escalate, and process erasure requests received through any channel (email, portal, verbal).\n\n**Detection & Audit measures:**\n- Maintain a central register of all DSARs with timestamps, actions taken, and response sent, to provide an auditable trail for regulatory inspections.\n- Schedule quarterly internal compliance reviews to verify that erasure requests result in confirmed deletion across all systems, including backups and third-party processors.",[12,13,14,15,16,17,18,19,20],"GDPR Article 12 – Transparent information and communication","GDPR Article 17 – Right to erasure ('right to be forgotten')","GDPR Article 5(1)(e) – Storage limitation principle","GDPR Article 24 – Responsibility of the controller","NIST Privacy Framework PR.DS-P4 – Data processing management","NIST SP 800-53 IP-1 – Individual Access","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Management – Request Fulfilment Practice",{},"published","2026-09-11T08:20:49.490826+00:00","2026-09-11T08:20:49.401+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Ffailure-to-respect-the-rights-of-individuals-the-cnil-fined-extia-300-000-eur_en","failure-to-respect-the-rights-of-individuals-the-cnil-fined-extia-300-000-eur-87cb96","Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUR",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[44],{"slug":45,"name":46,"problem":47},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]