CNIL (France) - SAN-2026-010
CNIL fines consulting firm EXTIA €300,000 for failing to handle erasure requests and inform data subjects under GDPR
France's CNIL (National Data Protection Authority) issued a €300,000 administrative fine against consulting firm EXTIA for systematic failures in handling data subject erasure requests and providing outcome notifications. The investigation found that 204 erasure requests (75% of 2024 requests) were improperly handled: 12 were not processed, 166 data subjects were not informed of outcomes, and 26 requests received late responses. Despite the company's claims of automatic deletion and departmental disorganization, the DPA determined these failures violated Articles 12 and 17 GDPR, especially after two previous formal notices.
AI summary of the linked source. Not reviewed by an editor. How this works
Run EXTIA?
Get an email when a new story names EXTIA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonEXTIA's systematic failure to process, acknowledge, and respond to data subject erasure requests demonstrates a critical breakdown in GDPR operational compliance, not just policy awareness. Of 272 total erasure requests, 204 were mishandled — either ignored, responded to late, or completed without notifying the requestor — violating both the right to erasure (Article 17) and communication obligations (Article 12). The severity of the fine was compounded by the fact that CNIL had already issued two prior formal notices, meaning EXTIA had repeated opportunities to remediate and failed to do so. This case highlights that vague claims of 'automatic deletion' or internal disorganization are not acceptable defenses under GDPR, and that regulators will escalate enforcement against repeat offenders. Organizations must treat data subject rights as operational processes requiring tracking, accountability, and audit trails — not informal workflows.