On 9 September 2026, the CNIL published a decision fining EXTIA €300,000 after the IT and engineering company failed to handle candidates’ and former employees’ erasure requests reliably. The underlying decision was made on 21 July 2026. The case is a useful warning for HR and recruitment teams: deleting a record is only one part of the job. You also need to identify the request, make a defensible decision within the deadline and tell the requester what happened.
What happened at EXTIA
EXTIA received 265 erasure requests in 2024, most from candidates and some from former employees. The CNIL said that more than three quarters were either not handled or handled unsatisfactorily. Twelve requests were not processed at all. A further 166 people were not told what action had been taken, while 27 received the information late, outside the legal one-month deadline. Some delays lasted several months.
The CNIL’s restricted committee treated these failures as breaches of Articles 12 and 17 of the GDPR. It also considered the number of people affected and the fact that EXTIA had previously been reminded of its obligations. EXTIA took remedial steps during the procedure, including deleting relevant data and informing individuals, but those steps did not remove the earlier failures.
Why automatic deletion did not solve the problem
EXTIA argued that many requests concerned candidates whose data had already been deleted automatically. The CNIL rejected that as a complete answer. Automatic deletion may help an organisation comply with a retention schedule, but it does not by itself close an individual-rights request. The organisation still needs to know which person and records the request concerns, establish what action was taken and communicate the outcome.
This is the operational lesson. A retention rule is a background control. An erasure request is a tracked case with an owner, evidence and a response. If the two systems are not connected, a team may delete data without being able to prove that it did so, or may send no response because the deletion happened in a different system.
How an erasure workflow fails in practice
1. The request arrives in the wrong place
A candidate may email a recruiter, reply to an automated hiring message or contact a former manager. If staff do not recognise the request as a data-protection matter, the clock can start running without anyone recording it. Train recruitment and HR teams to route requests to one monitored queue, even when the wording is informal.
2. Nobody owns the deadline
Under GDPR Article 12, the organisation must communicate information about action taken on a request without undue delay and in any event within one month, subject to the regulation’s limited extension rules. Put one named owner on the case, record the receipt date and set an escalation before the deadline rather than on it.
3. The search does not match the person
Recruitment data is often spread across an applicant-tracking system, shared drives, recruiter inboxes, interview notes, talent-pool exports and supplier platforms. The owner should confirm the person’s identity, search the systems named in the retention and records map, and document what was checked. If the organisation genuinely cannot identify the requester, record that reason and explain the limitation rather than allowing the case to disappear.
4. The team assumes deletion is always required
The right to erasure is not absolute. GDPR Article 17 includes circumstances in which retention may still be necessary, such as compliance with a legal obligation or the establishment, exercise or defence of legal claims. That does not justify a blanket refusal. The decision-maker should identify the specific data, purpose and exception, retain only what is necessary, and explain the outcome clearly.
5. The response is forgotten after the action
Closing the case means sending the requester a secure, understandable response. It should say whether the data was erased, whether some data was retained and why, and what the person can do if they disagree. Keep a record of the response and delivery. In EXTIA’s case, the CNIL made clear that automatic deletion did not remove the obligation to inform candidates of the result.
A practical control list for HR and recruitment
- Give every incoming rights request a unique case reference and receipt date.
- Nominate one owner and a deputy who can act during absence.
- Search the applicant-tracking system, HR records, relevant email and approved supplier systems.
- Record the data considered, the deletion action and any Article 17 exception relied on.
- Set an internal response target well before one month, with escalation for unresolved cases.
- Send the outcome to the requester and retain evidence that it was sent.
- Review missed, late or disputed cases periodically for a process-level fix.
What managers should do next
Ask three questions this week: where can a candidate or former employee make a rights request, who sees it first and how is the one-month deadline monitored? Then test the workflow with a sample request. A tabletop exercise should expose whether recruiters know where to route it, whether the data map is usable and whether the final response is actually sent.
The wider message from the EDPB coordinated action on the right to erasure is practical: rights need operating procedures, not only policy wording. Teams that handle personal data should understand the rights they may receive and the hand-off expected of them. Measured Collective’s GDPR Essentials course provides a baseline for managers and staff who need that shared understanding.
Frequently asked questions
What was the EXTIA fine?
The CNIL fined EXTIA €300,000. The decision was made on 21 July 2026 and published on 9 September 2026.
What did EXTIA fail to do?
The CNIL found that requests were not processed properly and that many requesters were not informed, or were informed late, about the action taken.
Does automatic deletion answer an erasure request?
No. Automatic deletion may be relevant evidence, but the organisation still needs to assess the request and communicate the outcome.
