French Data Protection Authority Fines IT and Engineering Consultancy EXTIA €300,000 for Failure to Respect Data Subjects' Rights

The Restricted Committee of the Commission Nationale de l'Informatique et des Libertés ("CNIL") imposed a €300,000 administrative fine on EXTIA, a company specialising in IT and engineering that recruits consultants for technical projects carried out for its client companies, under a decision ("the Decision") dated July 21, 2026 and announced on September 9, 2026.

The Decision followed several complaints received by the CNIL in 2024 from former employees and candidates concerning difficulties in exercising their right to erasure. In order to investigate these complaints, and within the framework of the Coordinated Enforcement Framework action on the right to erasure launched by the European Data Protection Board in 2025, the CNIL carried out an audit of EXTIA in April 2025, which identified breaches of the GDPR relating to transparency and the rights of individuals.

Within the scope of the Decision, the CNIL made, among others, the following key determinations:

• EXTIA received 265 erasure requests in 2024, most of which came from candidates and, occasionally, from former employees. More than three quarters of these requests had either not been handled at all or had not been handled satisfactorily.
• A breach of Articles 12 and 17 of the GDPR was established on the basis that 12 erasure requests received in 2024 had not been processed. The CNIL considered that this failure adversely affected the rights of the individuals concerned, including their right to retain control over their personal data.
• A breach of Article 12 of the GDPR was established in relation to the company's obligation to inform individuals of the action taken on their requests. 166 individuals who had submitted erasure requests in 2024 were not informed of the outcome of their requests, and a further 27 individuals received this information after the one-month legal deadline, with delays of up to several months.
• In determining the amount of the fine, the CNIL took into account the infringement of essential principles relating to the rights of individuals, the number of persons concerned, and the fact that EXTIA had already been reminded of its obligations on two previous occasions.

You can access the Decision here (English) and here (French).

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr

All information and documents on our website have been prepared by Zumbul Attorneys at Law for general informational purposes only, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of Attorneyship of the Union of Turkish Bar Associations. These publications are not intended for advertising or commercial purposes. The information and documents provided are of a general nature and under no circumstances, do they guarantee or warrant that the content is complete, accurate, up-to-date, or reliable. You should not rely on the information and documents on this website without first consulting a lawyer or expert. The links included in our website's publications are sourced from publicly available materials and are provided solely for the convenience of visitors in accessing additional information. These links do not constitute any form of recommendation or endorsement of the linked persons, institutions or organizations. The information on this website does not in any way constitute legal advice or establish an attorney-client relationship with visitors to the site. All content on this website is the property of Zumbul Attorneys at Law, and no content may be copied, reproduced, or used without prior written permission.