EXIA – €300,000 Fine (France, 2026)

EXTIA, the controller, is a French consulting company specialising in IT and engineering services. As part of its recruitment activities, the controller processed personal data of job applicants and employees. Following complaints received in 2024 concerning difficulties in exercising the rights of access and erasure, the French Data Protection Authority (CNIL) sent the controller two formal notices reminding it of its obligations under the GDPR. As the controller failed to provide satisfactory responses, further complaints were lodged with the DPA. On 10 April 2025, the DPA conducted an on-site inspection of the controller's premises. The investigation revealed that the controller had received 265 erasure requests in 2024, mainly from unsuccessful job applicants, but had failed to properly handle a significant proportion of them. In particular, the investigation identified requests that had not been processed, requests for which data subjects had not been informed of the outcome, and requests to which the controller had responded after the applicable deadline. The controller argued that many of the requests concerned unsuccessful applicants whose personal data had already been automatically deleted 60 days after their applications were received. It also attributed the shortcomings to the temporary disorganisation of its legal department and a substantial increase in erasure requests. The DPA initiated sanction proceedings against the controller for alleged infringements of Articles 12, 13 and 17 GDPR. During the proceedings, the controller submitted additional evidence of the deletion of personal data and the measures taken to inform the affected data subjects. The DPA found that the controller infringed Articles 12 and 17 GDPR by failing to properly handle erasure requests and inform data subjects of the outcome of their requests. First, the DPA established that the controller had failed to process 12 erasure requests in violation of Articles 12 and 17 GDPR. Alt