Administrative fine of 300,000 euros imposed by the French Data Protection Authority on the company EXTIA for violating the right to erasure of personal data

       The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine of 300,000 euros imposed by the French Data Protection Authority (CNIL) on EXTIA for infringements of Articles 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and 17 (Right to erasure (‘right to be forgotten’) of GDPR.

       In 2024, the CNIL received several complaints from former employees and candidates of EXTIA, a company specialising in information technology and engineering, concerning difficulties encountered in exercising their right to the erasure of personal data. In this context, and as part of the coordinated action on the right to erasure launched in 2025 at the initiative of the European Data Protection Board, the CNIL carried out an inspection of EXTIA in April 2025, identifying the lack of transparency and failure to respect the data subjects’ rights.

       Of the 265 erasure requests received by the company in 2024, most of which were submitted by candidades and, in some cases, former employees, more than three-quarters were not handled appropriately. Specifically, 12 requests were not examined, while 166 individuals were not informed of the action taken in response to their requests. Another 27 individuals were notified only after the statutory one-month deadline had expired, with delays extending to several months in some cases.

       In this context, the CNIL imposed an administrative fine of 300,000 euros on EXTIA, taking into account the seriousness of the infringements affecting data subjects’ rights, the number of individuals concerned and the fact that EXTIA had previously been reminded on two occasions of its obligations regarding personal data protection.

       The NCPDP, as the national supervisory authority for the processing of personal data, emphasises that controllers are responsible for ensuring respect for data subjects’ rights and for examining and responding to their requests within the time limits and under the conditions established by the applicable personal data protection legislation.