EXTIA Fined €300K for Failing to Honor GDPR Erasure Requests
French consulting firm EXTIA was fined €300,000 by CNIL for systematically failing to process data subject erasure requests and neglecting to inform individuals of outcomes, violating GDPR Articles 12 and 17. The root cause reflects a lack of mature internal processes and accountability for managing data subject rights, a critical operational obligation under GDPR. This matters because organizations handling personal data must treat rights requests as a formal, time-bound compliance workflow—not an ad hoc administrative task. Failure to do so exposes companies to significant regulatory penalties, reputational damage, and erosion of public trust in data handling practices.
Tactical Insight
Immediate actions
- Audit all outstanding data subject rights requests (erasure, access, rectification) and resolve any backlog within GDPR's 30-day response window.
- Designate a named Data Protection Officer or rights-request coordinator accountable for tracking and responding to every incoming request.
Process & Workflow improvements
- Implement a dedicated ticketing or case management system to log, track, and escalate data subject rights requests with automated deadline reminders.
- Establish templated response communications to ensure data subjects are formally notified of the outcome of every request, whether fulfilled or refused.
- Define and document an internal SLA for rights requests that is stricter than the GDPR statutory deadline to build in buffer time for review.
Long-term compliance measures
- Conduct periodic internal audits and simulated rights-request exercises to validate that processes function correctly end-to-end.
- Integrate GDPR rights-request handling into employee onboarding and annual compliance training so all relevant staff understand their obligations.
- Maintain a structured Record of Processing Activities (RoPA) that maps where personal data resides, enabling faster and more complete erasure execution.