Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

CNIL Fines EXTIA EUR 300,000 for Failures in Data Subject Rights Exercise

Fine: EUR 300,000

The CNIL fined EXTIA EUR 300,000 on 21 July 2026 for multiple failures in handling data subject erasure requests. This decision follows an audit in April 2025, which identified breaches of GDPR obligations regarding transparency and individual rights.

The CNIL's restricted committee found that 12 requests for erasure received by EXTIA were not processed, adversely affecting individuals' control over their data. Additionally, 166 individuals who submitted an erasure request were not informed of the action taken, breaching Article 12 of the GDPR. Another 27 individuals received information late, beyond the one month statutory deadline, with delays extending to several months. The fine considered the infringement of essential principles relating to individual rights, the number of persons concerned, and EXTIA having received two prior reminders of its obligations. The investigation began after multiple complaints from former employees or candidates regarding difficulties exercising their right to erasure, and was part of a Coordinated Enforcement Framework action on the 'Right to erasure' launched by the EDPB in 2025.

Organisations frequently struggle with the operational complexities of fulfilling data subject rights requests, as evidenced by the 265 erasure requests EXTIA received in one year.

Original title: Non respect des droits des personnes : sanction de 300 000 euros à l’encontre de la société EXTIA

CNIL administrative fine

Who this binds
All organisations processing personal data in France are legally bound by the GDPR to respond to data subject requests.
What changed
The CNIL's decision clarifies that failure to process erasure requests and inform data subjects of actions taken constitutes a breach of Articles 12 and 17 GDPR.
What to check
Organisations should review their processes for handling data subject erasure requests, particularly ensuring timely processing and communication of outcomes, as required by Article 12 GDPR.
What this does not mean
This decision does not imply that all data subject requests must result in data erasure; it concerns the proper processing and communication of the request itself.

Send this to your team

The CNIL fined EXTIA EUR 300,000 for failing to process data subject erasure requests and inform individuals of actions taken, underscoring the importance for all organisations to comply with GDPR Articles 12 and 17.

Today's question

An audit by the CNIL found that EXTIA failed to process 12 erasure requests and did not inform 166 individuals of actions taken on their erasure requests. Which GDPR Articles were breached by these failures?

  1. Articles 12 and 17
  2. Articles 5 and 6
  3. Articles 28 and 32
  4. Articles 33 and 34

Answer this question on the site

Worth knowing

  1. ICO Investigates Police Scotland Over Subject Access Request Compliance

    Organisations, especially public bodies, should ensure robust processes for handling subject access requests as regulators like the ICO are actively investigating non compliance with statutory deadlines.

  2. New York AG Secures $8 Million Settlement from Online Sweepstakes Casino Operator

    Digital service providers should be aware that state Attorneys General are actively pursuing enforcement actions against online businesses, which can include data related aspects even if not explicitly detailed in initial press releases.

  3. Italian Garante Fines Banco Bilbao Italia EUR 5.5 Million

    Financial institutions operating in Italy should review their data processing practices, as the Garante is imposing significant fines for non compliance, signaling a strict enforcement environment.

  4. Dutch DPA Publishes Authorisation Form for Processor Data Breach Notifications

    Controllers engaging processors should consider using the Dutch DPA's new authorization form to formalize data breach notification responsibilities, ensuring clarity and compliance with Article 33 GDPR.

  5. Medical Groups Settle Class Action Data Breach Lawsuits

    The class action settlements by Palomar Health and Summit Health demonstrate that even without specific financial details, healthcare providers face tangible legal and financial repercussions from data breaches.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.