CNIL (France) - SAN-2026-010

CNIL - SAN-2026-010
Authority:	CNIL (France)
Jurisdiction:	France
Relevant Law:	Article 12 GDPR Article 17 GDPR Article 20, Law No. 78-17 of 6 January 1978 relating to data processing, files and freedoms
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	21.07.2026
Published:	09.09.2026
Fine:	300000.0 EUR
Parties:	EXTIA
National Case Number/Name:	SAN-2026-010
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	French
Original Source:	CNIL (in FR)
Initial Contributor:	bms

The DPA fined consulting firm EXTIA €300,000 for failing to properly handle erasure requests and to inform data subjects of the outcome of their requests in accordance with Articles 12 and 17 GDPR.

English Summary

Facts

EXTIA, the controller, is a French consulting company specialising in IT and engineering services. As part of its recruitment activities, the controller processed personal data of job applicants and employees.

Following complaints received in 2024 concerning difficulties in exercising the rights of access and erasure, the French Data Protection Authority (CNIL) sent the controller two formal notices reminding it of its obligations under the GDPR. As the controller failed to provide satisfactory responses, further complaints were lodged with the DPA.

On 10 April 2025, the DPA conducted an on-site inspection of the controller's premises. The investigation revealed that the controller had received 265 erasure requests in 2024, mainly from unsuccessful job applicants, but had failed to properly handle a significant proportion of them.

In particular, the investigation identified requests that had not been processed, requests for which data subjects had not been informed of the outcome, and requests to which the controller had responded after the applicable deadline. The controller argued that many of the requests concerned unsuccessful applicants whose personal data had already been automatically deleted 60 days after their applications were received. It also attributed the shortcomings to the temporary disorganisation of its legal department and a substantial increase in erasure requests.

The DPA initiated sanction proceedings against the controller for alleged infringements of Articles 12, 13 and 17 GDPR. During the proceedings, the controller submitted additional evidence of the deletion of personal data and the measures taken to inform the affected data subjects.

Holding

The DPA found that the controller infringed Articles 12 and 17 GDPR by failing to properly handle erasure requests and inform data subjects of the outcome of their requests.

First, the DPA established that the controller had failed to process 12 erasure requests in violation of Articles 12 and 17 GDPR. Although the controller argued that many applicants' personal data had already been automatically deleted after 60 days, the DPA found that this did not exempt it from its obligations regarding the exercise of data subject rights.

Second, the DPA found an infringement of Article 12 GDPR because 166 data subjects had not been informed of the outcome of their erasure requests. The DPA recalled that controllers must inform data subjects of the measures taken in response to their requests, regardless of whether their personal data has already been erased or can lawfully be retained.

Third, the DPA found a further infringement of Article 12 GDPR because the controller had responded late to 26 erasure requests and one access request. The DPA emphasised that controllers must respond within one month unless a justified extension is communicated to the data subject within that period.

In total, 204 erasure requests received in 2024 had not been properly handled, representing more than three-quarters of the requests received that year. The alleged infringement of Article 13 GDPR concerning information provided to employees was withdrawn and was not established.

The DPA imposed a €300,000 administrative fine, taking into account the number of affected data subjects, the controller's negligence and its failure to comply with its obligations despite two previous formal notices. Although the controller had subsequently implemented corrective measures, these did not remove its responsibility for the infringements.

The DPA decided not to issue an injunction, as the controller had demonstrated that it had addressed the infringements. It also ordered the publication of the decision, which will be anonymised after two years.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

Decision SAN-2026-010 of July 21, 2026

National Commission for Information Technology and Civil Liberties

Nature of the decision: Sanction

Date of publication on Légifrance: Wednesday, September 9, 2026
Decision No. SAN-2026-010 of the Select Panel dated July 21, 2026, concerning the company EXTIA

The National Commission for Information Technology and Civil Liberties, meeting in its select panel composed of Mr. Philippe-Pierre CABOURDIN, Chair; Mr. Vincent LESCLOUS, Vice Chair; Ms. Isabelle LATOURNARIE-WILLEMS; Mr. Didier KLING and Mr. Bertrand du MARAIS, members;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;

Pursuant to Law No. 78-17 of January 6, 1978, on Information Technology, Filing Systems, and Civil Liberties, in particular articles 20 et seq.;

Having regard to Decree No. 2019-536 of May 29, 2019, adopted to implement Law No. 78-17 of January 6, 1978, on Information Technology, Filing Systems, and Civil Liberties;

Having regard to Resolution No. 2013-175 of July 4, 2013, adopting the regulations of the National Commission for Information Technology and Civil Liberties;

Having regard to Decision No. 2025-1154 QPC of August 8, 2025, of the Constitutional Council;

Pursuant to Decision No. 2025-054C of April 8, 2025, by the Chair of the National Commission for Information Technology and Civil Liberties, instructing the Secretary General to conduct or arrange for an audit of the processing operations carried out by or on behalf of the company EXTIA;

Having regard to the decision of the President of the National Commission on Information Technology and Civil Liberties appointing a rapporteur before the select panel on March 4, 2026;

Whereas the report of Ms. Sophie LAMBREMON, reporting commissioner, dated March 12, 2026, was served on EXTIA on March 13, 2026;

Whereas the written observations submitted by EXTIA on April 13, 2026;

Having regard to the rapporteur’s response, served on EXTIA on May 7, 2026;

Having regard to the new written observations submitted by EXTIA on June 8, 2026;

Having regard to the notification to EXTIA on June 15, 2026, that the investigation had been closed;

Having regard to the letter from the Chair of the select panel dated June 15, 2026, informing the company that the case was on the agenda for the select panel’s meeting on July 2, 2026;

Having regard to the oral arguments presented during the session of the restricted panel on July 2, 2026;

Having regard to the other documents in the file;

The following were present at the session of the select panel on July 2, 2026:

- Ms. Sophie LAMBREMON, Commissioner, whose report was heard;

As representatives of EXTIA:

- […]

EXTIA having been informed of its right to remain silent regarding the allegations against it and having been given the last opportunity to speak;

The restricted panel adopted the following decision:

I. FACTS AND PROCEDURE

1. EXTIA (hereinafter “the company”) is a simplified joint-stock company established in 2007, with its principal place of business located at 1 Avenue de la Cristallerie in Sèvres (92310). It is a consulting firm specializing in the IT and engineering sectors, with approximately twenty offices in France. The company employed 2,000 employees in 2025, including 1,600 to 1,700 consultants.

2. The company’s business is based on assigning consultants to technical, digital, and/or engineering projects for its enterprise clients. The company recruits consultants either through traditional channels—that is, when a candidate responds to a job posting published on the company’s website or on specialized websites where the company posts its openings (“passive recruitment”)— or through direct contact, initiated by the company, with candidates who have submitted their resumes on specialized websites (“active recruitment”).

3. In 2024, EXTIA generated revenue of […], with net income of […]. In 2023, its revenue totaled […], with net income of […]. On its website, the company reports significantly higher revenue figures for the years 2023 […], 2024, and 2025 […].

4. The attention of the National Commission for Information Technology and Civil Liberties (hereinafter “the CNIL” or “the Commission”) was drawn to the data processing activities carried out by the company following two complaints received on April 16 and June 17, 2024, which detailed the difficulties encountered by the complainants in exercising their right of access and their right to erasure. Following these complaints, the CNIL sent two formal notices to the company on April 19 and June 20, 2024, reminding it of its obligations regarding the processing of requests to exercise rights as a recipient. In the absence of a satisfactory response from the company to these requests, two new complaints were filed with the CNIL on June 3 and November 7, 2024.

5. On April 10, 2025, a CNIL delegation conducted an on-site inspection at EXTIA’s headquarters to verify that the processing operations complied with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter “ GDPR”) and with Law No. 78-17 of January 6, 1978, as amended, relating to information technology, filing systems, and civil liberties (hereinafter “Data Protection Act” or “Law of January 6, 1978, as amended”). The report drawn up following this inspection was served on the company on two occasions, on April 11 and April 25, 2025, due to a clerical error that had crept into the initial report.

6. The company provided the delegation with additional information on April 30 and May 12, 2025.

7. For the purpose of reviewing this information, the Chair of the Commission appointed Ms. Sophie LAMBREMON as rapporteur on March 4, 2026, pursuant to article 22 of the amended Act of January 6, 1978.

8. On March 12, 2026, following her review, the rapporteur served the company with a report detailing the violations of articles 12, 13, and 17 of the GDPR that she deemed to have occurred in this case. This report recommended that the panel impose an administrative fine on the company, as well as an order to bring its processing practices into compliance with the aforementioned provisions, accompanied by a penalty payment. She also proposed that this decision be made public but that it no longer be possible to identify the company by name upon the expiration of a two-year period from the date of its publication.

9. On April 13, 2026, the company submitted comments in response to the sanction report.

10. The rapporteur responded to these comments on May 7, 2026.

11. On June 8, 2026, the company submitted further comments in response.

12. By letter served on June 15, 2026, the rapporteur, pursuant to Section III of Article 40 of Decree No. 2019-536 of May 29, 2019, enacted to implement the Data Protection Act (hereinafter, “the Decree of May 29, 2019”), informed the company that the investigation had been closed.

13. On the same day, the company was informed that the case had been placed on the agenda of the restricted panel meeting scheduled for July 2, 2026.

14. The rapporteur and the company presented oral arguments during the session of the restricted panel.

II. GROUNDS FOR THE DECISION

A. Regarding the processing operations in question and EXTIA’s status as a controller

15. Legally, Article 4(7) of the GDPR defines the controller as “the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing.”

16. In the present case, the Panel notes that the processing operations at issue in these proceedings relate to human resources management and concern, on the one hand, the data of job applicants and, on the other hand, the data of the company’s employees. It is clear from the investigation that the company recruits consultants to provide its IT and engineering consulting services, and that their recruitment occurs either through their application to a job posting published online or at the company’s initiative, which directly contacts a potentially relevant candidate.

17. EXTIA explained in its defense brief that the consultant recruitment process involves several stages, during which candidates are classified into different categories (“unsolicited applicants not shortlisted,” “unsolicited applicants shortlisted,” “qualified candidates,” “qualified candidates not selected,” “qualified candidates selected”). Initially, the company conducts a preliminary screening of the unsolicited applications it receives. The company states that all data related to unsolicited applications—regardless of whether the candidates are preselected or not—is stored in a database titled “Unsolicited Applicants Database” within the […], developed by the company, and is automatically deleted 60 days after the application is submitted. In a second step, data related to unsolicited applications that have been shortlisted are transferred to a separate database, the “Qualified Candidates Database,” where they are combined with data from candidates who may have been identified through an “active search” conducted by the company. At this stage, a “candidate profile” is created for each qualified candidate. In the third stage, candidates qualified for the second phase enter a recruitment process, at the end of which they are either selected or not. The company states that the data of qualified candidates who are not selected is stored by default in the “Qualified Candidates Database” for two years from the date of their last interaction with the company. Finally, selected candidates become employees of the company, and their data is transferred to a new database. 

18. With regard to accountability for processing, the panel notes that EXTIA informed the delegation, during the on-site inspection on April 10, 2025, that it is responsible for the processing of personal data carried out in connection with the recruitment of its employees. Furthermore, the company’s record of processing activities identifies it as the controller for human resources processing, which specifically includes the administrative management of personnel, compensation, recruitment, and communication. Finally, the company stated that it was responsible for the design, development, administration, and maintenance of the […], which enables the digitization of internal processes and, in particular, the management of job applications.

19. The Chamber of Limited Composition considers that, in light of these facts, the company must be regarded as the controller of the human resources processing operations at issue in these proceedings, which involve, in particular, the processing of personal data of applicants and employees for the purposes of recruitment and personnel management.

B. Regarding the evidence on which the violations identified in the report are based

20. The company criticizes the rapporteur for having conducted an investigation that it describes as “rushed,” arguing that further discussions should have taken place before the sanction report was drafted to ensure a proper understanding of the processing activities carried out. In particular, it argues that it cannot be held accountable for not having voluntarily provided information that had not been requested of it during the investigation, specifically regarding the stages of the recruitment process and the 60-day storage period it states it applies to the data of “non-shortlisted” candidates.

21. Furthermore, the company believes that the rapporteur erroneously relied on an internal tracking table of requests to exercise data rights to infer the existence of violations based on certain entries or omissions in the table. According to the company, this table was merely an internal tool, not intended to serve as evidence. It notes that, moreover, the table was not entirely reliable given the temporary disorganization of the legal team and the receipt of an exceptionally high number of requests for erasure following the sending, to non-shortlisted candidates, of a notice that erroneously stated a two-year storage period for their data, whereas the period actually applied was, in the company’s view, 60 days.

22. The panel notes, first of all, that the audit phase allowed the audit team to collect, according to the terms of the on-site audit report, “all individual files regarding requests to exercise the right to erasure received by the company in 2024, as well as the responses provided thereto,” along with the internal tracking table for erasure requests maintained by the company. These files and this table, on which the rapporteur relies in her sanction report, as well as their reliability, were subsequently discussed, and the company was able to provide several clarifications regarding the processing operations in question during the adversarial proceedings. All of these clarifications were taken into account by the rapporteur in her response and by the panel, which has the entire case file at its disposal to render a decision.

23. Next, with regard more specifically to the fact that the company mentioned for the first time, in its written submissions, that the storage period applied to the data of non-shortlisted candidates was 60 days, rather than two years, the panel notes that this is a factual matter evident from the review of the case file. Given that this storage period had not been mentioned during the on-site inspection—which focused on the company’s processing of requests for erasure—and that it was not mentioned in any of the company’s internal documents, the rapporteur was justified in questioning the company about the origin and actual application of this storage period and, more generally, in asking the company to substantiate its statements, as she is authorized to do pursuant to Article 39, paragraph 2, of the Decree of May 29, 2019, which provides that the rapporteur may “request that the respondent provide any document or information she deems useful.”

24. The panel notes, in any event, that following the written exchanges between the company and the rapporteur, in accordance with the principle of adversarial proceedings, the company acknowledged, during the hearing before the panel, that the documents on which the rapporteur based her allegations of violations were not disputed.

25. The panel therefore considers that the complaint alleging that the rapporteur’s response was intended to remedy deficiencies in the investigation, as well as the criticisms regarding the weight given to the company’s internal tracking table for erasure requests, must be dismissed.

C. Regarding Violations of Individual Rights

26. Under the law, Article 15(1) of the GDPR provides that “the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to such personal data as well as the following information:

(a) the processing purposes;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients established in third countries or international organisations;

d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

e) the existence of the right to request from the controller the rectification or erasure of personal data, or the restriction of the processing of personal data concerning the data subject, or the right to object to such processing;

f) the right to lodge a complaint with a SA;

g) where the personal data are not collected from the data subject, any available information regarding their source;

h) the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4), and, at least in such cases, relevant information regarding the underlying logic, as well as the significance and the anticipated consequences of such processing for the data subject.”

Paragraph 3 of the same article provides that “the controller shall provide a copy of the personal data undergoing processing.”

27. Under Article 17 of the GDPR:

“1. The data subject has the right to obtain from the controller the erasure, as soon as possible, of personal data concerning him or her, and the controller is obligated to erase such personal data as soon as possible, where one of the following grounds applies:

(a) the personal data are no longer necessary in light of the purposes for which they were collected or otherwise processed;

b) the data subject withdraws the consent on which the processing is based, in accordance with Article 6(1)(a) (…) and there is no other legal basis for the processing;

c) the data subject objects to the processing pursuant to article 21(1), and there are no compelling legitimate grounds for the processing, or the data subject objects to the processing pursuant to article 21(2) […] ".

28. Pursuant to Article 12 of the GDPR:

" 3. The controller shall provide the data subject with information on the action taken in response to a request made pursuant to Articles 15 through 22 as soon as possible and, in any event, within one month of receiving the request. If necessary, this period may be extended by two months, taking into account the complexity and number of requests. The controller shall inform the data subject of such an extension and the reasons for the delay within one month of receiving the request. When the data subject submits the request electronically, the information shall be provided electronically where possible, unless the data subject requests otherwise.

4. If the controller does not act on the request made by the data subject, it shall inform the data subject without delay, and no later than one month after receipt of the request, of the reasons for its inaction and of the possibility of lodging a complaint with a SA and seeking judicial remedy. […]".

29. In the present case, it appears from the investigation that the company has formalized an internal procedure for handling complaints and requests to exercise rights, under which it states that requests from applicants are systematically granted, whereas requests from former employees—who represent a marginal proportion of the requests received—are reviewed in light of the company’s legal obligations, any legitimate grounds it may have for storing their data, or in the event of a dispute. 

30. The record also shows that in 2024, the company was the recipient of 28,322 applications and 265 requests for erasure, almost all of which came from former applicants.

1. Regarding the violation concerning the processing of requests for erasure (Articles 12 and 17 of the GDPR)

Under the law, Article 17 of the GDPR defines the conditions for exercising the right to erasure. Whether or not a request for erasure is granted, in whole or in part, Article 12 of the GDPR provides that the controller must inform the data subject of the measures taken in response to the request.

31. The rapporteur notes that in 2024, the company was a recipient of 265 requests for erasure. However, she notes that the evidence gathered during the investigation shows that 145 of these requests for erasure were not processed, even though they contained sufficient information to identify the data subject and, where applicable, to proceed with the erasure of their data.

32. In its defense, the company argues, in its second set of observations, that only 12 requests (as opposed to the 7 initially cited by the company in its first set of observations) out of the 145 mentioned in the report were not granted. In this regard, it emphasizes, first, that 125 requests concerned candidates who were not shortlisted, whose data were automatically erased 60 days after receipt. It concludes that these 125 requests were moot with regard to the right to erasure, as this right had already been respected given the aforementioned deletion period. The company explains that at the pre-selection stage, an automated email was sent to this group of candidates informing them that their applications had been rejected, and that this email erroneously stated that their data would be stored for two years, even though the storage period actually applied to them was 60 days. Second, the company argues that eight requests involved special circumstances: Two individuals could not be identified; four individuals were former employees whose data was legally stored; one individual’s request became moot because it had been processed prior to the on-site inspection; and one request was more akin to a comment than a request for erasure. In general, the company emphasizes that it prioritized the actual processing of requests for erasure over communicating with individuals, given the operational disorganization of its legal department, compounded by a surge in requests resulting from the erroneous informational email sent to candidates who had not been shortlisted. The company emphasizes that in the overwhelming majority of cases covered by this violation, the only shortcoming was the failure to inform individuals, not an actual failure to perform the erasure of the data. It asserts, in any case, that it has remedied the alleged communication error since February 2025 by providing adequate information to unsolicited applicants who were not shortlisted.

33. In her response, the rapporteur notes that the company does not support its statements with any documentation or clarification, particularly regarding the origin of the 60-day storage period, which it mentions for the first time only in response to the sanction report. Nor does it provide evidence of the actual deletion of data pertaining to the unselected applicants affected by the violation. However, assuming that the company did in fact apply this storage period to the data of unselected applicants, she considers that, on the one hand, the violation still stands for some of the requests and, on the other hand, with regard to the remaining requests, the automatic deletion of data after a 60-day period did not exempt the company from informing the data subjects of the action taken on their requests, which it failed to do.

34. The Panel of Three notes, first of all, that while the company disputes the number of requests cited in the report, the violation regarding the failure to process requests for erasure is established for 12 of the requests submitted to it in 2024, based on the analysis of the individual requests for erasure, confirmed by the tally provided by the company itself in its most recent submissions.

35. Next, regarding the 125 requests that, according to the company, were in practice granted through automatic deletion following a 60-day period from receipt of the application, the rapporteur emphasized that the company had mentioned the existence of this storage period only in its comments in response to the penalty report, that it was not formalized in any internal company document relating to personal data governance, and that the email sent to candidates who were not shortlisted did not mention a 60-day storage period, but rather a 2-year period.

36. The panel takes note of the company’s statements, in which it maintains that the evidence in the file does not support a finding of a violation of Article 17 of the GDPR with respect to these 125 individuals. The alleged violation cited by the rapporteur regarding the provision of information to individuals will be examined below, in section 2.

37. Finally, with regard to the 8 individuals who, according to the company, fall under special circumstances, the panel notes that specific circumstances made it materially impossible to process some of these requests or rendered them moot. However, the company cannot validly rely on the fact that 4 of these individuals are former employees to justify failing to process their requests for erasure without providing specific reasons why those requests were not granted. Furthermore, regardless of the company’s potential legal justification for storing their data under statutory requirements, the panel will examine in point 2 below whether these facts constitute, as the rapporteur contends, a failure to inform the individuals.

38. Consequently, the panel considers that the failure to process 12 requests for erasure received in 2024, and the resulting lack of information, constitute a violation of the provisions of articles 12 and 17 of the GDPR.

39. The panel notes, however, that in its latest submissions, the company demonstrates that the data of all individuals initially identified in the report as affected by this breach are no longer present in the database, except for a very small number of them, for whom the company has justified the storage of the data on the grounds that they concerned former employees or individuals who had submitted a new job application.

40. Thus, while the violation remains established with respect to past events, issuing an injunction, as proposed by the rapporteur, no longer appears appropriate.

2. Regarding the failure to inform data subjects of the follow-up to their request for erasure (Article 12 of the GDPR)

41. Legally, it follows from the provisions of Article 12, paragraphs 3 and 4 of the GDPR that, regardless of the action taken in response to a request to exercise rights, the controller must inform the data subject of those actions, either by confirming that the request has been granted or by explaining the reasons for not acting and reminding the data subject of their right to lodge a complaint with a SA and to seek judicial remedy.

42. The rapporteur notes that 37 individuals who submitted a request for erasure to the company in 2024 had not, as of the date of the inspection, been informed of the outcome of their request.

43. In its defense, the company argues that the majority of the 37 requests for erasure in question (the company cited the figure of 19 in its initial observations, then 22 in its second set of observations) concerned candidates who had not been shortlisted, whose data had been automatically deleted 60 days after receipt of their applications. Thus, only 15 requests concerned candidates who had actually continued the recruitment process with the company.

44. In her response, the rapporteur also noted, with regard to the requests for erasure initially included in her report concerning the breach of Articles 12 and 17 of the GDPR examined above, that even if a 60-day storage period had in fact been automatically applied to the data of non-shortlisted candidates, the deletion of the data subjects’ data did not relieve the company of its obligation to inform them of the action taken in response to their request, which it failed to do.

45. The Panel notes that, as previously stated, the fact that the data was actually erased has no bearing on the company’s obligation to inform the data subjects of the outcome of their request, whether it was granted or not—an obligation the company acknowledges it failed to fulfill.

46. Regarding the number of data subjects affected by this violation, the panel notes that of the 265 data subjects who submitted a request for erasure in 2024, 166 were not informed of the outcome of their request. In fact, in addition to the 37 individuals initially identified in the sanction report, there were 129 individuals who submitted requests for erasure regarding whom the company stated, for 125 of them, that the data had been deleted 60 days after receipt, and, for 4 of them, that certain data had to be stored in accordance with legal requirements and due to their status as former employees. The panel notes that the company provided the supervisory delegation with all individual files regarding requests for erasure submitted in 2024, as well as, where applicable, “the responses provided to them.” However, a review of the individual files of these 166 individuals revealed that none of the files contained an email in which the company had informed them of the outcome of their request, a fact which the company does not dispute. 

47. In light of these facts, the Panel notes that a total of 166 individuals who submitted a request for erasure in 2024 were not informed of the outcome of their request within the required time frame.

48. The Panel considers that these facts constitute a violation of Article 12 of the GDPR.

49. In its final comments, the company states that, while it still had the data available to do so, it informed all data subjects affected by this violation of the outcome of their requests. For the vast majority of these individuals, this information was provided via an email sent on April 14, 2026; the remaining data subjects were informed, also by email, shortly before or shortly after that date. For the 12 individuals to whom this information could not be provided, the company cited valid reasons; in particular, the deletion of the data subject’s contact information, a failure to deliver the message (full inbox or address not found), or the inability to identify the data subject. Consequently, while the violation remains established with respect to past events, issuing an injunction on this point no longer appears necessary.

3. Regarding the delay in the responses provided to the data subjects concerning the follow-up to their requests to exercise their rights (Article 12 of the GDPR)

50. Under the law, in accordance with Article 12, paragraphs 3 and 4 of the GDPR, the controller is required to respond to requests to exercise rights addressed to it within one month. In the event of an extension of this deadline under the conditions set forth in paragraph 3, as well as in cases where the data subject’s request is not granted, the data subject must receive information tailored to their situation within one month of receipt of their request.

51. The rapporteur notes that the company responded to at least 27 requests for erasure as well as one access request submitted to it during the year 2024, with delays of up to several months.

52. In its defense, the company emphasizes that 10 of these requests for erasure concerned candidates who were not shortlisted, whose data had been automatically deleted 60 days after they submitted their applications. Thus, while it acknowledges that these individuals were indeed notified late, the company considers that the right to erasure had, in practice, already been respected for nearly one-third of them. It further argues that one of these requests, dated 2025, falls outside the time frame of the allegations in the report, which pertains to requests received in 2024. The company attributes these delays to the difficult operational context it faced in 2024, marked by a temporary disruption in its legal department, which resulted in the need to prioritize processing requests over notifying individuals.

53. The panel notes that the erasure request dated 2025 is not included among the 265 erasure requests reported to the CNIL following the audit and that the case file documents demonstrate that the request was granted in any event.

54. It further notes that the company does not contest the breach and that nothing in the case file indicates that the company informed the individuals who submitted these requests of any difficulties that would have justified an extension of the one-month deadline set forth in Article 12(3) of the GDPR. Consequently, the company should have informed these individuals of the action taken within the one-month period provided for in that provision.

55. However, the panel notes that it is evident from the individual files regarding requests to exercise rights, as well as from the information in the table tracking erasure requests, that there were 26 erasure requests (and not 27—given what is mentioned in paragraph 53 above) that resulted in the data subjects being informed with delays of up to more than five to six months. Furthermore, an access request received by the company in 2024 resulted in the data subject being informed of the action taken in response more than one year late.

56. The Panel notes that the obligation to respond to requests to exercise rights received by a controller within one month of receipt constitutes an independent obligation that cannot be offset by the automatic erasure of data. Therefore, the fact that the data of 10 of the 26 data subjects were subject to erasure 60 days after receipt, as indicated by the company, did not exempt the company from responding to these requests, which it did belatedly for all 26 requests.

57. The Panel finds that these facts constitute a violation of Article 12 of the GDPR, insofar as 26 individuals who submitted a request for erasure and one individual who submitted an access request were informed of the measures taken in response to their requests after the one-month deadline provided for in that article.

D. Regarding the breach of the obligation of transparency and information with respect to employees

58. Under the law, Article 13(1) of the GDPR requires the controller to provide the data subject, at the time the data is collected from them, various pieces of information, including, in particular, the controller’s identity and contact details, the processing purposes, the legal basis for the processing, the recipients or categories of recipients of the data, and whether the controller intends to conduct data transfers to a third party.

59. Article 13(2) of the GDPR further requires, to ensure fair and transparent processing of personal data, that individuals be informed of the data storage period, the rights to which they are entitled, the right to withdraw consent at any time, and the right to lodge a complaint with a SA.

60. In her report, the rapporteur noted that the information provided to the company’s new employees in the “certificate regarding the processing of personal data” given to them concerning the processing of their data—in particular for personnel management purposes—did not include any mention of the data storage period. In light of the documentation and explanations provided by the company in its defense, the rapporteur, in her response and during the hearing, indicated that she was dropping this allegation.

61. The panel therefore finds that the violation is no longer asserted by the rapporteur and that, in any event, it has not been established.

III. ON CORRECTIVE MEASURES

62. Article 20-IV of Law No. 78-17 of January 6, 1978, as amended, provides that: “where the controller or its processor fails to comply with the obligations arising from Regulation (EU) 2016/679 of April 27, 2016, or from this Act, the President of the National Commission for Information Technology and Civil Liberties may […] refer the matter to the Commission’s restricted panel for the purpose of issuing, following an adversarial proceeding, one or more of the following measures: […] An order to bring the processing into compliance with the obligations arising from Regulation (EU) 2016/679 of April 27, 2016, or this Act, or to comply with requests submitted by the data subject to exercise their rights, which may be accompanied, except in cases where the processing is carried out by the State, a daily penalty not exceeding 100,000 euros per day of delay, calculated from the date set by the panel;

[…]

7° Except in cases where the processing is carried out by the State, an administrative fine not exceeding 10 million euros or, in the case of an enterprise, 2 percent of the total worldwide annual revenue for the preceding fiscal year, whichever is higher. In the cases referred to in paragraphs 5 and 6 of Article 83 of Regulation (EU) 2016/679 of April 27, 2016, these limits are increased to 20 million euros and 4% of said revenue, respectively. In determining the amount of the fine, the Chamber of Limited Composition takes into account the criteria specified in the same article 83.”

Article 83 of the GDPR, as referred to in Article 20, paragraph IV, of the French Data Protection Act, provides that: “Each SA shall ensure that administrative fines imposed pursuant to this article for infringements of this Regulation referred to in paragraphs 4, 5, and 6 are, in each case, effective, proportionate, and dissuasive,” before specifying the factors to be taken into account when deciding whether to impose an administrative fine and when determining the amount of such a fine.

63. Finally, article 22, paragraph 2, of the Data Protection Act provides that “the restricted panel may make public the measures it takes.”

A. On the Imposition of an Administrative Fine and Its Amount

64. The panel notes that the relevant criteria set forth in Article 83 of the GDPR must be examined to determine whether an administrative fine should be imposed on the company and, if so, to determine its amount.

1. On the Imposition of an Administrative Fine

65. The rapporteur proposes that the restricted panel impose an administrative fine on the company for the violations of Articles 12 and 17 of the GDPR.

66. In its defense, the company argues that the severity of the violations is limited, since the majority of the requests for erasure identified by the rapporteur as having not been processed—in violation of Article 17 of the GDPR— concerned data subjects whose data had already been deleted after a 60-day period. It believes that this circumstance must be taken into account and that the remaining violations under Article 12 of the GDPR primarily concern the absence or insufficiency of information provided to the data subjects regarding the follow-up to their requests. Furthermore, the company emphasizes its cooperation with the CNIL throughout the proceedings, the fact that the duration of the non-compliance is limited to the year 2024, as well as its proactivity in implementing corrective measures. 

67. The Chamber notes that, in assessing whether to impose a fine, it must take into account the criteria set forth in Article 83 of the GDPR, such as the nature, gravity, and duration of the violation, the scope or processing purpose, the number of data subjects affected, the measures taken by the controller to mitigate the damage suffered by the data subjects, whether the violation was committed through negligence, the degree of cooperation with the SA, the categories of data involved, and the level of damage suffered by the data subjects.

68. First, the Chamber considers that the criterion set forth in article 83, paragraph 2, (a) of the GDPR regarding the nature, gravity, and duration of the breach, taking into account the nature, scope, or purpose of the processing in question, as well as the number of data subjects affected.

69. The Panel notes, first of all, that breaches of Articles 12 and 17 of the GDPR fall within the scope of Article 83(5) of the GDPR and are thus subject to the highest fine provided for by the European legislature, namely 20 million euros or, in the case of an enterprise, up to 4 percent of its annual global revenue—a provision that in itself attests to the seriousness of the violations in question.

70. The Chamber of the General Court emphasizes that the violations committed by the company concern the fundamental principles of personal data protection and infringe upon individuals’ rights. It emphasizes that respect for the right to erasure and the principle of transparency are essential to enabling individuals to retain control over their data, by ensuring that such data is not stored longer than necessary and, in any event, by informing them of how their data is being processed when they submit a request to that effect.

71. The Panel wishes to emphasize the significant number of data subjects affected by the identified violations regarding the exercise of the right to erasure. Indeed, even after the company finally stabilized the number of requests that were deleted after a 60-day period, a total of 204 requests for erasure were not properly processed in 2024 alone, either because these requests were not processed (12), because the data subjects were not kept informed of the outcome of their request (166), or because they were informed after the deadline (26). In total, therefore, more than three-quarters of the requests to exercise the right to erasure received in 2024 were not processed or were not processed satisfactorily by EXTIA.

72. The Panel of Judges considers that the fact that most of the data for which individuals requested erasure had, in practice, already been deleted has no bearing on the existence of violations, the scope of which varies only in part. Indeed, on the one hand, for virtually all of these requests (namely 129 out of 133), a failure to inform the individuals remains established. On the other hand, the panel wishes to emphasize that the automatic deletion of the data of 125 candidates who were not shortlisted after a 60-day period, as argued by the company in an attempt to minimize its accountability, cannot obscure the fact that none of these 125 requests was, strictly speaking, reviewed by the company at the time of receipt.

73. Finally, as the rapporteur noted, the failures to comply with the obligation to respond to requests to exercise rights were long-standing. In fact, the company had already received two formal notices from the CNIL in April and June 2024 reminding it of its obligations regarding the processing of requests to exercise rights. However, as of the date of the on-site inspection, April 10, 2025, more than three-quarters of the requests to exercise rights received in 2024 had not been processed correctly, or had not been processed at all. This situation persisted—at the very least with regard to the failure to inform data subjects about the follow-up to their requests—as of the date the penalty report was sent, March 12, 2026. the panel notes that, while the company claims to have implemented, as of December 2024, a new organizational structure designed to enable it to respond to requests to exercise rights within the time limits set by the GDPR, this measure had not proven effective as of the date of the inspection. It further notes that the vast majority of individuals who submitted a request for erasure in 2024—and who were identified by the rapporteur as not having been informed of the outcome of their request—were not informed only after the penalty report was served.

75. Second, the panel considers that the criterion set forth in Article 83(2)(b) of the GDPR—regarding whether the violation was committed intentionally or through negligence—should be taken into account.

76. The panel emphasizes that the number of data subjects affected by the failures to address requests to exercise rights reveals a particular degree of negligence on the part of the company. It notes that more than 200 requests resulted in violations of the GDPR, whether due to delays in processing, a failure to inform the data subjects, or a complete failure to process the requests.

77. However, as noted, the company had already been issued two formal warnings regarding its obligations to comply with requests to exercise data subject rights. During the hearing before the panel, the company acknowledged that it had been slow to respond to a situation that had already prompted two formal warnings from the CNIL in 2024.

78. These facts demonstrate clear negligence in complying with data protection regulations. This negligence is all the more evident given that the company has the necessary resources, such as an in-house team and a procedure dedicated to handling requests to exercise rights received from applicants and, on a more occasional basis, from former employees.

79. Third, regarding the specific cooperation the company claims to have demonstrated with the CNIL, the panel notes that the company provided essential information for the investigation belatedly—as this information was submitted at the stage of its defense brief, with the aim of contesting the violations identified in the report—and that some of this information was insufficiently substantiated. In this regard, the panel reiterates, as noted by the rapporteur, that article 5, paragraph 2 of the GDPR establishes a principle of accountability for the controller, under which the latter must be able to demonstrate compliance with the principle of transparency, which includes, in particular, informing data subjects of the procedures for exercising their rights (Recital 39 of the GDPR). It also notes that the figures provided by the company differed between its initial and subsequent submissions; this discrepancy raises doubts as to the thoroughness with which the company verified, upon receipt of the penalty notice, the disposition of the requests related to the violations identified in the report. The panel further emphasizes that it was in its comments of June 8, 2026, that the company demonstrated that it had adopted certain compliance measures, such as sending emails informing the data subjects affected by the failure to provide information of the action taken regarding their request, which was filed in 2024.

80. Accordingly, the panel finds that the company has not demonstrated a particular level of cooperation with the CNIL that would warrant consideration as a mitigating circumstance, bearing in mind that, pursuant to Article 31 of the GDPR, the controller “shall cooperate with the SA, at its request, in the performance of its tasks.” In this regard, Guidelines 04/2022 of the European Data Protection Board on the calculation of administrative fines under the GDPR state that the controller “is subject to a general obligation to cooperate under Article 31 of the GDPR (…). It should therefore be considered that the ordinary duty to cooperate is mandatory and that this factor must therefore be deemed neutral (and not considered a mitigating factor)” (paragraph 96).

81. Finally, while taking into account that the company has, to date, adopted measures to ensure its compliance, the restricted panel notes that these actions were taken, for the most part, in response to the initiation of sanction proceedings and that, in any event, they do not exempt the company from accountability for past conduct. All of these factors justify the imposition of a financial sanction.

83. Consequently, the panel considers that an administrative fine should be imposed for the violations of Articles 12 and 17 of the GDPR.

2. Regarding the amount of the administrative fine

84. In its defense, the company requests a substantial reduction in the proposed fine, taking into account, in particular, the dismissal of the alleged violation of Article 13 of the GDPR, the “significant development in the allegation based on Article 17 of the GDPR,” its cooperation with the CNIL, its proactive efforts to implement corrective measures, and its actual profit for the year 2024. 

85. The Chamber of Appeal notes that violations of articles 12 and 17 of the GDPR constitute breaches of fundamental principles of the GDPR, which may, pursuant to Article 83 of the GDPR, an administrative fine of up to 20,000,000 euros or up to 4% of annual turnover, whichever is higher.

86. It then notes that the company’s financial situation must also be taken into account. In this regard, it points out that EXTIA’s revenue amounted to […] with a net income of […] in 2024, […] with a net income of […] in 2023, and that its preliminary revenue for fiscal year 2025 amounts to […]. The panel notes that the company reports significantly higher revenue figures on its website for the years 2023 […], 2024, and 2025 […]. When questioned on this point during the hearing before the panel, the company clarified that the revenue figures reported on its website corresponded to EXTIA’s global revenue, and that those reported in the financial statements submitted to the CNIL corresponded to EXTIA’s revenue in France. Finally, it notes that administrative fines must be dissuasive and proportionate.

87. Thus, in light of the company’s accountability, its financial capacity, and the relevant criteria of paragraph 2 of Article 83 of the GDPR mentioned above, the panel considers that an administrative fine in the amount of three hundred thousand (300,000) euros to penalize the violations of Articles 12 and 17 of the GDPR appears to be deterrent and proportionate.

88. In her report, the rapporteur proposed that the panel issue an injunction against the company requiring it to bring the processing operations in question into compliance with the provisions of Articles 12, 13, and 17 of the GDPR, accompanied by a penalty payment.

89. In its final submissions, the company provided supporting documentation demonstrating that the data of the data subjects affected by the violations had been deleted and that they had been informed of the action taken in response to their requests, where this was practically possible.

90. In the letter informing the company of the conclusion of the investigation, and subsequently during the hearing on July 2, 2026, the rapporteur clarified that, given the measures EXTIA claims to have implemented, she considers that there is no longer any need to seek the issuance of an injunction under articles 12 and 17 of the GDPR. Furthermore, since the rapporteur confirmed the withdrawal of the alleged violation of Article 13 of the GDPR in her response and during the hearing, and since no such violation has been established, there is no basis for issuing an injunction under article 13 of the GDPR.

91. In light of the above considerations and the company’s compliance with regard to the identified violations, the panel finds that there is no basis for issuing an injunction.

C. On the Publication of the Sanction In its defense, the company argues that publication of the decision would be disproportionate, particularly in light of its cooperation during the proceedings, the fact that most of the requests for erasure were in fact moot given that the data had already been deleted, and the remedial measures it has implemented. It argues that such publication is likely to cause serious harm to its reputation, as well as to the relationship of trust established with its customers and partners, upon which its business model relies.

93. The panel notes that the violations identified concern a very large number of individuals relative to the number of requests for erasure received in 2024, and that the automatic deletion of certain candidates’ data did not alter the total number of data subjects affected by violations of their rights. The panel also notes, as the rapporteur pointed out, that the company had already been reminded of its legal obligations by the CNIL without taking the necessary corrective action.

94. In light of these factors, the panel considers that a public disclosure measure is warranted. It finds that this measure appears proportionate, given that the decision will no longer identify the company by name after a period of two years from its publication.

FOR THESE REASONS

The CNIL’s restricted panel, after deliberation, decides to:

- impose on the company EXTIA, an administrative fine in the amount of three hundred thousand (300,000) euros for violations of articles 12 and 17 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016;

- publish its decision on the CNIL website and the Légifrance website, in a form that will no longer allow the company to be identified by name two years after publication.

The President

Philippe-Pierre CABOURDIN

This decision may be appealed to the Council of State within two months of its notification.