CNIL fines EXTIA €300,000 over failures to respect erasure rights, showing that deleting data is not enough if organisations do not process requests and inform individuals within the GDPR deadline.
The European Data Protection Board (EDPB) has reported that the French Data Protection Authority imposed a EUR 300,000 fine on IT and engineering consultancy EXTIA after finding failures in its handling of erasure requests from job candidates and former employees. The decision focuses on Articles 12 and 17 of the GDPR and highlights an operational point that can be overlooked: an organisation must not only take appropriate action on a request, but also tell the individual what it has done within the required time.
The CNIL decision followed complaints received in 2024 and an audit conducted in April 2025. The investigation also formed part of the EDPB coordinated enforcement action on the right to erasure. Of the 265 erasure requests EXTIA received in 2024, more than three quarters had not been handled or had not been handled satisfactorily.
The sanction followed repeated failures to process and acknowledge erasure requests.
The CNIL restricted committee found that 12 requests received in 2024 had not been processed. It considered that this failure affected the individuals’ ability to retain control over their personal data. During the procedure, EXTIA deleted the data concerned and informed those individuals of the action taken, but this later remediation did not erase the original infringement.
The regulator identified a broader communication failure. A total of 166 people who requested erasure in 2024 were not informed of the action taken, while another 27 received a response outside the GDPR’s one-month deadline. In some cases, the delays extended for several months.
Automatic deletion did not remove the obligation to respond to individuals.
EXTIA argued that many requests concerned candidates whose data had already been deleted automatically. The CNIL rejected the suggestion that this reduced the seriousness of the communication failure. Automatic deletion may address the underlying retention issue, but it does not tell the requester whether the organisation received the request, whether the data were erased or whether any information was retained under an applicable exception.
Article 12 requires controllers to provide information on action taken without undue delay and, in principle, within one month of receiving the request. Where an organisation cannot identify the requester or cannot comply fully, it still needs a controlled process for explaining the position where possible. The regulator accepted that EXTIA had valid reasons for not responding in a residual number of cases where the person could not be identified.
Recruitment systems require the same rights controls as customer databases.
The case is particularly relevant to employers and recruitment businesses because candidate information is often spread across applicant-tracking systems, email accounts, shared folders, assessment platforms and talent pools. A single request may therefore require coordinated action across several systems and teams, including external processors.
Candidate data can also remain commercially useful after a recruitment process ends, encouraging organisations to retain profiles for future opportunities. That does not displace the GDPR. Organisations need a clear retention basis, transparent information and a reliable way to locate and erase data when the right applies. Former employees may present additional complexity because some records must be retained to meet legal or employment obligations, making a documented assessment essential.
A rights workflow must track both the action and the response.
A complete workflow should record when a request was received, how identity was assessed, which systems and recipients were searched, what data were erased, whether an exemption applied and when the individual was informed. Treating deletion and communication as separate workflow steps can prevent a technically completed request from remaining legally unanswered.
Ownership should also be clear. Front-line staff need to recognise a rights request even when it does not use formal GDPR language, while privacy, HR, recruitment and IT teams need defined responsibilities and escalation routes. Deadline reminders, case status controls and evidence of the final response can help organisations demonstrate compliance when request volumes increase.
Repeated warnings and the number of affected people increased the enforcement risk.
In setting the EUR 300,000 fine, the CNIL considered the infringement of essential principles relating to individuals’ rights, the number of people concerned and the fact that EXTIA had previously been reminded of its obligations on two occasions. The decision shows why unresolved process weaknesses can become more serious when an organisation has already received complaints or regulatory attention.
Remedial action remains important because it can stop continuing harm and improve future compliance. However, organisations should not rely on corrections made during an investigation. Testing request-handling procedures before complaints arise is more effective than reconstructing cases after deadlines have passed.
The decision reinforces the need for measurable data subject rights governance.
Data subject rights compliance cannot be demonstrated by a privacy notice alone. Organisations should be able to measure how many requests they receive, how quickly they acknowledge and resolve them, where delays occur and whether final responses are consistently sent. Periodic sampling can reveal cases marked complete internally even though the individual was never informed.
For organisations processing substantial volumes of candidate, employee or customer data, these controls should be part of routine privacy governance. Accurate data inventories, retention rules, processor arrangements and staff training all support the practical ability to find information and respond within the statutory period.
Discover how Aphaia helps organisations operationalise data subject rights compliance.
Aphaia helps organisations design and review practical processes for receiving, assessing and responding to GDPR rights requests. Clear workflows, defined responsibilities and reliable records can reduce delays, support consistent decisions and demonstrate accountability to individuals and regulators.
