What Changed
- The CNIL sanctioned EXTIA EUR 300,000 for failing to respect individuals' right to erasure under Articles 12 and 17 of the GDPR.
- An April 2025 audit revealed that over three-quarters of 265 erasure requests in 2024 were ignored, handled late, or processed improperly.
- The sanction reflects prior warnings given to EXTIA, the high volume of affected data subjects, and the severity of violating core privacy rights.
The French Data Protection Authority (CNIL) has imposed a sanction fine of 300,000 EUR on EXTIA, an IT and engineering consultancy, for failing to fulfill obligations regarding data subject rights under the General Data Protection Regulation (GDPR). The enforcement action directly affects recruitment candidates, former employees, and human resources and compliance professionals handling data subject requests within the European Union.
The case originated in 2024 following multiple complaints received by the CNIL from former employees and job applicants who experienced difficulties when attempting to exercise their right to erasure, also known as the 'right to be forgotten'. Following an audit conducted in April 2025 as part of the European Data Protection Board’s (EDPB) Coordinated Enforcement Framework action on the 'Right to erasure', the CNIL identified widespread non-compliance in how EXTIA handled erasure requests.
Out of 265 erasure requests received by EXTIA in 2024, primarily from candidates and former employees, more than three-quarters were not processed or were handled unsatisfactorily. Specifically, the CNIL's restricted committee identified three major breaches:
1. Complete failure to process requests: 12 erasure requests were not processed at all, directly infringing on the rights of individuals under Articles 12 and 17 of the GDPR to maintain control over their personal data.
2. Failure to inform data subjects: 166 individuals who submitted erasure requests were never informed of the action taken regarding their data, violating Article 12 GDPR.
3. Delayed responses: 27 individuals received notification of the action taken past the statutory one-month deadline, with delays extending up to several months.
In determining the penalty of 300,000 EUR, the CNIL took into account the gravity of breaching essential principles governing individual rights, the total number of individuals affected, and the fact that EXTIA had previously been reminded of its obligations on two separate occasions.
This decision highlights the stringent regulatory expectations across the European Union regarding data subject rights management under Articles 12 and 17 GDPR, emphasizing that corporate entities must maintain timely, transparent, and complete procedures for handling erasure requests from candidates and staff.
Who May Be Affected
Recruitment candidates, former employees, and human resources and compliance personnel managing candidate data within the EU.
Cross-Border Context
Reflects coordinated EU-wide data protection enforcement under the EDPB Coordinated Enforcement Framework, impacting EU employers and recruitment entities handling applicant personal data.
What to check next
- Official CNIL publication of the sanction decision dated 21 July 2026 for complete procedural details.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.
Prepared automatically with AI assistance from the official sources linked on this page. Translations and explanations do not replace the official text.