Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUR
EDPB news report on CNIL enforcement decision against EXTIA (final decision 21 July 2026) for failure to comply with GDPR Articles 12 and 17. CNIL found that EXTIA failed to process or adequately process more than three-quarters of 265 erasure requests received in 2024 from candidates and former employees. The decision imposed an administrative fine of 300 000 EUR. This case is part of the Coordinated Enforcement Framework action on 'Right to erasure' initiated by EDPB in 2025.
What changed
- CNIL enforced Article 12 (transparent information and modalities for exercise of data subject rights) and Article 17 (right to erasure) through administrative fine
- Enforcement action demonstrates EDPB Coordinated Enforcement Framework on right to erasure
Who is affected
EXTIA (IT and engineering company) and similar organizations subject to GDPR obligations regarding data subject rights, particularly the right to erasure.
- Language
- EN