A purge that runs on a schedule does not answer the person who asked for deletion. That is the lesson of a decision the Commission nationale de l’informatique et des libertés (CNIL), France’s data protection authority, published on 9 September 2026. Its restricted committee, the body inside the CNIL responsible for issuing sanctions, fined the recruitment and consulting company EXTIA 300,000 euros. The decision itself, deliberation SAN-2026-010, was taken on 21 July 2026.
How the case reached the regulator
EXTIA specialises in IT and engineering. It recruits consultants and places them on technical projects at client companies. During 2024 the CNIL received several complaints from former employees and candidates. They said they could not exercise their right to erasure, the right under Article 17 of the General Data Protection Regulation to have personal data about them deleted. An audit of the company followed in April 2025.
The numbers came out of that audit. EXTIA had received 265 erasure requests during 2024, most from candidates and some from former employees. More than three quarters were not dealt with, or not dealt with satisfactorily. Twelve were never processed at all. A further 166 people were never told what action had been taken. Others were informed outside the legal deadline of one month, with delays running to several months.
Deleting and replying are two separate duties
The company’s main defence was that many requests came from candidates whose data had already been deleted automatically, so nothing remained to erase. The restricted committee did not accept that this closed the matter. Automatic deletion did not exempt the company from informing those candidates of the outcome of their requests. The duty to reply is owed to the person, and a retention rule running in the background does not discharge it.
The breaches were found under Article 12 of the Regulation, which governs transparency and the practical arrangements for exercising data subject rights, read together with Article 17. In setting the amount, the committee weighed the disregard of essential principles about individuals’ rights, the number of people affected, and two earlier reminders sent to EXTIA about its obligations. No injunction was imposed, because the company deleted the data and informed the individuals during the procedure. Publication was ordered, with the company’s name to be withheld two years afterwards.
One detail matters for anyone citing the case. The deliberation records 26 late erasure requests plus one late access request. The CNIL’s summary page instead describes 27 people informed late, without separating the access request. The total is the same but the composition differs, and the deliberation is the authoritative text.
A European exercise behind a national fine
The audit did not stand alone. The CNIL states that it was carried out in the context of the coordinated action on the right to erasure, launched on the initiative of the European Data Protection Board (EDPB) in 2025. That action ran under the Coordinated Enforcement Framework, the mechanism through which national authorities examine one topic together in the same year.
The EDPB adopted its report on that action on 18 February 2026. Thirty-two data protection authorities took part during 2025. Nine opened new formal investigations or continued existing ones, and 23 carried out a fact-finding exercise. In total 764 controllers across Europe responded.
The report listed seven recurring challenges. One sits close to the EXTIA file: some controllers leaned on weak anonymisation techniques as a substitute for deletion. Authorities also reported difficulty in fixing retention periods and in deleting data held in back-ups. The Board noted that erasure is not an absolute right, and that controllers struggle with the balancing tests that decide when it applies. The coordinated action for 2026 turns to transparency and information obligations, the ground on which EXTIA was found wanting.
What it means in practice
For a lawyer advising an employer or a recruiter, the decision separates two questions that are often merged. The first is whether the data has gone. The second is whether the person was told, within a month, what happened to their request. An organisation can answer the first correctly and still be fined for the second. The practical test is the audit trail rather than the retention policy.
Sources
- Commission nationale de l’informatique et des libertés, Failure to respect the rights of individuals: EUR 300,000 fine against EXTIA, 9 September 2026.
- CNIL restricted committee, Deliberation SAN-2026-010 of 21 July 2026 concerning the company EXTIA, 21 July 2026.
- European Data Protection Board, EDPB identifies challenges hindering the full implementation of the right to erasure, 18 February 2026.
- PPC Land, CNIL fines EXTIA 300,000 euros over 204 mishandled erasure requests, September 2026.