CNIL fines EXTIA €300,000 after an audit run under the EDPB’s erasure sweep

What happened

The CNIL’s restricted committee (formation restreinte) fined EXTIA €300,000 on 21 July 2026 for failing to respect individuals’ rights, in particular the right to erasure under Article 17 GDPR and the response obligations under Article 12. The CNIL published the decision on 9 September 2026.

EXTIA is an IT and engineering consultancy that recruits consultants for technical projects at client companies. The people affected were mostly job candidates and, occasionally, former employees, not customers.

The numbers are what make the decision instructive. EXTIA received 265 erasure requests in 2024, and the CNIL found that more than three-quarters were not handled, or not handled satisfactorily. Twelve requests were never processed. 166 people were never told what had happened to their request. Another 27 were told, but outside the one-month deadline in Article 12(3), with delays of up to several months.

In setting the amount, the restricted committee pointed to the breach of essential principles of individuals’ rights, the number of people affected, and the fact that EXTIA had already been reminded of its obligations on two earlier occasions.

How the case connects to the EDPB’s erasure sweep

The CNIL opened its file after receiving several complaints in 2024 from former employees and candidates who had struggled to get their data erased. The audit itself, in April 2025, was carried out in the context of the EDPB’s 2025 Coordinated Enforcement Framework (CEF) action on the right to erasure. The CNIL says so expressly in its announcement.

The CEF is the EDPB’s mechanism for having national supervisory authorities examine the same GDPR obligation in parallel during a given year and then pool their findings. In the 2025 round, 32 supervisory authorities took part and 764 controllers responded, from SMEs to large companies and public bodies. The consolidated report was adopted on 10 February 2026 and published on 18 February 2026. Nine authorities, France among them, ran the action as a formal investigation or used it to continue an existing one. Twenty-three treated it as fact-finding.

The report identifies seven recurring issues: no documented internal procedure for erasure requests, absent or inadequate staff training, insufficient information given to data subjects, misuse of the exceptions used to refuse erasure, difficulty defining and applying retention periods, deletion of data held in back-ups, and reliance on weak anonymisation as a substitute for deletion. EXTIA’s 166 uninformed requesters sit squarely in the third category.

Why this matters outside France

A CEF report is not binding law. It is a coordinated diagnostic. But it gives every participating authority the same map of where controllers fall short, and the EXTIA decision shows one of those authorities turning a CEF audit into a sanction. The report also notes that several other authorities planned enforcement or awareness-raising actions after its publication.

The route into this case is also worth noting. It began with several complaints about erasure requests, and the decision then rested on how the company handled all 265 requests it had received that year.

What to check

Start with whether your process for erasure requests is written down, has a deadline, and produces a record of what the requester was told, not only what was deleted internally. EXTIA’s largest failure was silence, not retention.

Next, look at the cases where you cannot erase fully, because of back-ups, legal holds or statutory retention. Is the reason recorded per request and communicated to the person, or simply assumed?

Then test your definition of “erased”. If it relies on anonymisation, make sure it would hold up against the EDPB’s concerns about techniques that fall short of deletion.

Finally, if you recruit or place staff, treat candidate and former-employee data with the same discipline as customer data. That was the population at issue here, and it is easy to under-govern.

Sources

• CNIL, “Failure to respect the rights of individuals: EUR 300,000 fine against EXTIA” (9 September 2026): https://www.cnil.fr/en/sanction-failure-rights-individuals-extia cnil.fr
• EDPB, “Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUR”: https://www.edpb.europa.eu/news/failure-to-respect-the-rights-of-individuals-the-cnil-fined-extia-300-000-eur_en edpb.europa.eu
• EDPB, “EDPB identifies challenges hindering the full implementation of the right to erasure” (18 February 2026): https://www.edpb.europa.eu/news/edpb-identifies-challenges-hindering-the-full-implementation-of-the-right-to-erasure_en edpb.europa.eu
• EDPB, “2025 Coordinated Enforcement Action: Implementation of the right to erasure by controllers” (adopted 10 February 2026): https://www.edpb.europa.eu/system/files/2026-02/edpb_cef-report_2025_right-to-erasure_en.pdf edpb.europa.eu