TL;DR
By deliberation SAN-2026-010 of 21 July 2026, published on 9 September, the CNIL fined Extia €300,000. Of 265 erasure requests received in 2024, mostly from job applicants, 204 had not been handled properly: 12 never processed (Arts. 12 and 17), 166 people never told the outcome, 27 told after the one-month deadline. The company argued that much of the data had already been deleted automatically. The CNIL replied that automatic deletion does not exempt from informing. The principles infringed, the number of people and two previous reminders all weighed on the amount.
The case
Extia recruits IT consultants and engineers and places them with client companies: it receives many applications, and therefore many erasure requests. In 2024 the CNIL received complaints from applicants and former employees who could not get their data erased. The April 2025 inspection was also part of the European Data Protection Board's coordinated action on the right to erasure launched in 2025: an inspection born of a European initiative that ends with a national fine.
- 265 erasure requests received in 2024, mostly from job applicants.
- 12 never processed: infringement of Articles 12 and 17. Remedied during the proceedings.
- 166 people never informed of the outcome of their request: infringement of Article 12(3).
- 27 people informed after the one-month deadline, with delays of up to several months.
- Two previous CNIL reminders of the same obligations: a factor that weighed on the amount.
The data is gone, the answer is still owed
Extia's defence was that many requests concerned applicants whose data had already been deleted automatically. The CNIL rejected the argument: automatic deletion does not exempt the controller from telling the person the outcome of their request within one month. They are two different obligations. For a residual number of cases the CNIL accepted the reasons given, for instance being unable to identify who had written: but that has to be shown, case by case.
Why it concerns everyone
Recruitment is the typical ground: many applicants, data kept for future openings, requests arriving at a generic address and getting lost. The 2025 European coordinated action led authorities to look precisely at this flow, and the inspections from that campaign are now producing decisions. The case also shows that reminders are not filed away: they come back in the reasoning of the next fine.
What to check now
- Every request logged with its date of receipt: the month runs from there, not from when someone reads it.
- A written reply to every request, even when the data has already been deleted or was never held.
- The two-month extension only for complex or numerous requests, notified to the person within the first month with reasons.
- A channel for applicants that actually reaches whoever handles requests, not only the recruitment team.
- Automatic deletions documented: which system, which rule, and when.
In the platform
In DPO Workspace's Data subject requests section every case has the date of receipt, the one-month deadline with any extension, and the date the reply was sent. It is worth opening a case even for erasure requests already met automatically: the case closes only when the person has been answered, and that date is what an authority asks for.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
