What Happened
In April 2025, the French Data Protection Authority (CNIL) audited EXTIA, an IT and engineering consulting firm, after multiple complaints from former employees and candidates about unprocessed erasure requests. The audit revealed systematic failures in handling data subject rights: of 265 erasure requests received in 2024, more than three-quarters weren't processed or were handled inadequately. The CNIL's restricted committee imposed a €300,000 fine, citing violations of Articles 12 and 17 of the General Data Protection Regulation.
This enforcement was part of the European Data Protection Board's 2025 Coordinated Enforcement Framework action targeting the right to erasure across member states. EXTIA had been warned twice before about its obligations.
Timeline
Throughout 2024: EXTIA received 265 erasure requests, mainly from recruitment candidates and occasionally from former employees.
2024: Multiple complainants contacted the CNIL, reporting difficulties exercising their right to erasure.
April 2025: CNIL conducted an audit as part of the European Data Protection Board's coordinated enforcement action on erasure rights.
2025 (post-audit): The CNIL's restricted committee issued its decision, imposing a €300,000 fine.
Which Controls Failed or Were Missing
The audit identified three operational breakdowns:
Complete non-processing: Twelve erasure requests received in 2024 were never acted upon. No deletion occurred, no assessment was documented, no response was sent. These requests disappeared into EXTIA's systems without acknowledgment.
Failure to communicate outcomes: 166 individuals who submitted erasure requests weren't informed whether their data had been deleted, retained under a legal basis, or partially processed. They submitted requests and heard nothing back.
Missed response deadlines: Another 27 individuals received responses, but outside the one-month timeframe required by Article 12. Some delays stretched to several months.
The issue wasn't a technical security breach or a data leak. It was the absence of a functioning process. EXTIA didn't lack the legal right to retain some data (legitimate interests in recruitment records exist). They lacked the operational machinery to receive a request, evaluate it against retention policies, execute the decision, and communicate the outcome.
What the General Data Protection Regulation Requires
Article 12(3) requires you to provide information on action taken on a Data Subject Access Request without undue delay and within one month of receipt. You can extend this by two months if the request is complex, but you must inform the requester of the extension within the first month and explain why.
Article 12(4) mandates that if you don't take action on a request, you must inform the individual within one month of the reasons for not acting and of their right to lodge a complaint with a supervisory authority.
Article 17(1) defines the right to erasure. Individuals can request deletion when: the data is no longer necessary for its original purpose; they withdraw consent (where consent was the legal basis); they object to processing and no overriding legitimate grounds exist; the data was unlawfully processed; or erasure is required for compliance with a legal obligation.
Article 17(3) provides exceptions. You can refuse erasure if processing is necessary for compliance with a legal obligation, for the establishment, exercise, or defense of legal claims, or for archiving purposes in the public interest. But refusing doesn't exempt you from responding.
The regulation requires more than a policy document. It demands a functioning intake system, a decision-making protocol tied to your legal bases for processing, an execution mechanism that touches every system where the data resides, and a communication workflow that closes the loop with the requester.
Lessons and Action Items for Your Team
Map every intake channel for data subject requests. EXTIA's candidates likely submitted requests via email, web forms, or direct messages to recruiters. If you don't funnel all channels into a tracked system, requests will vanish. Create a single queue (a ticketing system, a shared mailbox with SLA tracking, or a purpose-built Data Subject Access Request portal) and train every employee who might receive a request to route it there immediately.
Build a decision tree for erasure requests. Before the request arrives, document which data categories you can delete immediately, which require review against legal retention obligations (employment records, tax documentation, contracts), and which fall under Article 17(3) exceptions. Your team shouldn't be researching the law every time a request comes in. They should be following a pre-approved playbook.
Automate deadline tracking. The one-month clock starts when you receive the request, not when you get around to reviewing it. Your ticketing system should flag requests approaching the 30-day mark and escalate overdue items to management. The 27 late responses at EXTIA suggest no automated alerting existed.
Require documented outcomes for every request. Whether you delete the data, refuse based on a legal exception, or partially comply, create a record of what you decided and why. This serves two purposes: it forces a real decision (preventing the "ignored request" scenario), and it provides evidence if the individual complains or the regulator audits.
Test your process with internal audits. The CNIL noted EXTIA had been reminded of its obligations twice before this fine. Those warnings didn't trigger process changes. Run quarterly spot checks: submit test erasure requests through your public channels and measure how long it takes to receive a response, whether the response is accurate, and whether the data was actually deleted from all systems.
Communicate even when you refuse. If you're retaining data under Article 17(3), tell the requester which exception applies and why. "We're retaining your interview notes for six months to defend against potential discrimination claims" is a lawful response. Silence isn't.
The €300,000 fine reflects the CNIL's view that erasure rights aren't optional features. They're fundamental to the regulation's architecture. EXTIA's failure wasn't a one-time mistake or a borderline interpretation of a complex provision. It was systematic non-compliance at scale: 199 requests (12 unprocessed + 166 with no communication + 27 late) out of 265 total.
Your team doesn't need perfect systems. You need functioning ones. A spreadsheet tracking requests by date received, assigned owner, decision made, and response sent would have prevented most of this enforcement action. The regulation's one-month deadline is tight, but it's not impossible. It just requires you to treat data subject requests with the same operational rigor you apply to customer support tickets or vendor invoices.
If you haven't processed an erasure request in the last 12 months, don't assume you're compliant. Assume your intake process is broken and individuals aren't bothering to complain yet.
