CNIL fines EXTIA for failing to properly handle job applicant erasure requests

Decision SAN-2026-010 of July 21, 2026 National Commission for Information Technology and Civil Liberties Nature of the decision: Sanction Date of publication on Légifrance: Wednesday, September 9, 2026 Decision No. SAN-2026-010 of the Select Panel dated July 21, 2026, concerning the company EXTIA The National Commission for Information Technology and Civil Liberties, meeting in its select panel composed of Mr. Philippe-Pierre CABOURDIN, Chair, Mr. Vincent LESCLOUS, Vice Chair, Ms. Isabelle LATOURNARIE-WILLEMS, Mr. Didier KLING and Mr. Bertrand du MARAIS, members; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data; Pursuant to Law No. 78-17 of January 6, 1978, on Information Technology, Filing Systems, and Civil Liberties, in particular articles 20 et seq.; Having regard to Decree No. 2019-536 of May 29, 2019, adopted to implement Law No. 78-17 of January 6, 1978, on information technology, filing systems, and civil liberties; Having regard to Resolution No. 2013-175 of July 4, 2013, adopting the regulations of the National Commission for Information Technology and Civil Liberties; Having regard to Decision No. 2025-1154 QPC of August 8, 2025, of the Constitutional Council; Pursuant to Decision No. 2025-054C of April 8, 2025, by the President of the National Commission for Information Technology and Civil Liberties, instructing the Secretary General to conduct or arrange for an audit of the processing operations carried out by or on behalf of the company EXTIA; Having regard to the decision of the President of the National Commission for Information Technology and Civil Liberties appointing a rapporteur before the select panel on March 4, 2026; Whereas the report of Ms. Sophie LAMBREMON, reporting commissioner, dated March 12, 2026, was served on EXTIA on March 13, 2026; Whereas the written observations submitted by EXTIA on April 13, 2026; Having regard to the rapporteur’s response served on EXTIA on May 7, 2026; Having regard to the new written observations submitted by EXTIA on June 8, 2026; Having regard to the notification to EXTIA on June 15, 2026, that the investigation had been closed; Having regard to the letter from the chair of the select panel dated June 15, 2026, informing the company that the case was on the agenda of the select panel’s meeting on July 2, 2026; Having regard to the oral arguments presented during the session of the select panel on July 2, 2026; Having regard to the other documents in the file; The following were present at the session of the select panel on July 2, 2026: - Ms. Sophie LAMBREMON, Commissioner, whose report was heard; As representatives of EXTIA: - […] EXTIA having been informed of its right to remain silent regarding the allegations against it and having been given the last opportunity to speak; The restricted panel adopted the following decision: I. FACTS AND PROCEDURE

The attention of the National Commission for Information Technology and Civil Liberties (hereinafter “the CNIL” or “the Commission”) was drawn to the processing activities carried out by the company following two complaints received on April 16 and June 17, 2024, detailing the difficulties encountered by the complainants in exercising their right of access and their right to erasure. Following these complaints, the CNIL sent two formal notices to the company on April 19 and June 20, 2024, reminding it of its obligations regarding the processing of requests to exercise rights as a recipient. In the absence of a satisfactory response from the company to these requests, two new complaints were filed with the CNIL on June 3 and November 7, 2024.

On April 10, 2025, a CNIL delegation conducted an on-site inspection at EXTIA’s headquarters to verify the compliance of its data processing practices with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter “ GDPR”) and with Law No. 78-17 of January 6, 1978, as amended, on Information Technology, Filing Systems, and Civil Liberties (hereinafter “Data Protection Act” or “Law of January 6, 1978, as amended”). The report drawn up following this inspection was served on the company on two occasions, on April 11 and April 25, 2025, due to a clerical error in the initial report.

For the purpose of reviewing this information, the Chair of the Commission appointed Ms. Sophie LAMBREMON as rapporteur on March 4, 2026, pursuant to article 22 of the amended Act of January 6, 1978.

On March 12, 2026, upon completion of her review, the rapporteur served the company with a report detailing the violations of articles 12, 13, and 17 of the GDPR that she deemed to have occurred in this case. This report recommended that the panel impose an administrative fine on the company, as well as an order to bring its processing practices into compliance with the aforementioned provisions, accompanied by a daily penalty. She also proposed that this decision be made public but that it no longer be possible to identify the company by name after the expiration of a two-year period from the date of its publication.

By letter served on June 15, 2026, the rapporteur, pursuant to article 40(III) of Decree No. 2019-536 of May 29, 2019, enacted to implement the Data Protection Act (hereinafter, “the Decree of May 29, 2019”), informed the company that the investigation had been closed.

The rapporteur and the company presented oral arguments during the session of the restricted panel. II. GROUNDS FOR THE DECISION A. Regarding the processing activities in question and EXTIA’s status as a controller

Under the law, Article 4(7) of the GDPR defines the controller as “the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing.”

In this case, the Panel notes that the processing operations at issue in these proceedings relate to human resources management and concern, on the one hand, candidates’ data and, on the other hand, the company’s employees’ data. It is clear from the investigation that the company recruits consultants to provide its IT and engineering consulting services, and that their recruitment occurs either through their application to a job posting published online or at the company’s initiative, when it directly contacts a potentially suitable candidate.

With regard to accountability for processing, the panel notes that EXTIA informed the delegation, during the on-site inspection on April 10, 2025, that it is responsible for the processing of personal data carried out in connection with the recruitment of its employees. Furthermore, the company’s record of processing activities identifies it as the controller for human resources processing, which specifically includes the administrative management of personnel, compensation, recruitment, and communication. Finally, the company stated that it was responsible for the design, development, administration, and maintenance of the […], which enables the digitization of internal processes and, in particular, the management of job applications.

The Chamber of Limited Composition considers that, in light of these facts, the company must be regarded as the controller of the human resources processing operations at issue in these proceedings, which involve, in particular, the processing of personal data of applicants and employees for the purposes of recruitment and personnel management. B. Regarding the evidence on which the violations identified in the report are based

The company criticizes the rapporteur for having conducted an investigation that it describes as “rushed,” arguing that further discussions should have taken place before the sanction report was drafted to ensure a proper understanding of the processing activities carried out. In particular, it argues that it cannot be blamed for not having voluntarily disclosed information that had not been requested of it during the investigation, specifically regarding the stages of the recruitment process and the 60-day storage period it states it applies to the data of “non-shortlisted” candidates.

Furthermore, the company believes that the rapporteur wrongly relied on an internal tracking table of requests to exercise rights to infer the existence of violations based on certain entries or omissions in the table. According to the company, this table was merely an internal tool, not intended to serve as evidence. It notes that, moreover, the table was not entirely reliable given the temporary disorganization of the legal team and the receipt of an exceptionally high number of requests for erasure following the sending, to non-shortlisted candidates, of a notice that erroneously stated a two-year storage period for their data, whereas the period actually applied was, according to the company, 60 days.

The panel notes, first of all, that the inspection phase allowed the inspection team to collect, according to the minutes of the on-site inspection, “all individual files regarding requests to exercise the right to erasure received by the company in 2024, as well as the responses provided thereto,” along with the company’s internal tracking spreadsheet for erasure requests. These files and this table, on which the rapporteur relies in her sanction report, as well as their reliability, were subsequently discussed, and the company was able to provide several clarifications regarding the processing operations in question during the adversarial proceedings. All of these clarifications were taken into account by the rapporteur in her response and by the panel, which has the entire case file at its disposal to render a decision.

Next, with regard more specifically to the fact that the company mentioned for the first time, in its written submissions, that the storage period applied to the data of non-shortlisted candidates was 60 days, rather than two years, the panel notes that this is a factual matter evident from the review of the case file. Given that this storage period had not been mentioned during the on-site inspection—which focused on the company’s processing of erasure requests—and that it was not reflected in any of the company’s internal documents, the rapporteur was justified in questioning the company about the origin and actual application of this storage period and, more generally, in asking the company to substantiate its statements, as she is authorized to do pursuant to Article 39, paragraph 2, of the Decree of May 29, 2019, which provides that the rapporteur may “request that the respondent provide any document or information she deems useful.”

The panel therefore considers that the complaint alleging that the rapporteur’s response was intended to remedy deficiencies in the investigation, as well as the criticisms regarding the weight given to the company’s internal tracking table for erasure requests, must be dismissed. C. Regarding Violations of Individuals’ Rights

Under the law, Article 15(1) of the GDPR provides that “the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to such personal data as well as the following information: (a) the processing purposes; (b) the categories of personal data concerned; (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients established in third parties or international organisations; d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the controller the rectification or erasure of personal data, or the restriction of processing of personal data concerning the data subject, or the right to object to such processing; f) the right to lodge a complaint with a SA; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling, as referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, relevant information regarding the underlying logic, as well as the significance and the anticipated consequences of such processing for the data subject.” Paragraph 3 of the same article provides that “the controller shall provide a copy of the personal data undergoing processing.”

Under Article 17 of the GDPR: “1. The data subject has the right to obtain from the controller the erasure, as soon as possible, of personal data concerning him or her, and the controller is obligated to erase such personal data as soon as possible, where one of the following grounds applies: (a) the personal data are no longer necessary in light of the purposes for which they were collected or otherwise processed; b) the data subject withdraws the consent on which the processing is based, in accordance with Article 6(1)(a) (…) and there is no other legal basis for the processing; c) the data subject objects to the processing pursuant to Article 21(1), and there are no compelling legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) […] ".

Pursuant to Article 12 of the GDPR: " 3 The controller shall provide the data subject with information regarding the action taken in response to a request made pursuant to Articles 15 through 22 as soon as possible and, in any event, within one month of receiving the request. If necessary, this period may be extended by two months, taking into account the complexity and number of requests. The controller shall inform the data subject of this extension and the reasons for the delay within one month of receiving the request. When the data subject submits the request electronically, the information shall be provided electronically whenever possible, unless the data subject requests otherwise. 4 If the controller does not act on the request made by the data subject, it shall inform the data subject without delay, and no later than one month from receipt of the request, of the reasons for its inaction and of the possibility of lodging a complaint with a SA and seeking judicial remedy. […]”.

The record also shows that in 2024, the company was the recipient of 28,322 applications and 265 requests for erasure, almost all of which came from former applicants. 1 Regarding the violation concerning the processing of requests for erasure (Articles 12 and 17 of the GDPR) Under the law, Article 17 of the GDPR defines the conditions for exercising the right to erasure. Whether or not a request for erasure is granted, in whole or in part, Article 12 of the GDPR provides that the controller must inform the data subject of the actions taken in response to their request.

The rapporteur notes that in 2024, the company was a recipient of 265 requests for erasure. However, she notes that the evidence gathered during the investigation shows that 145 of these requests for erasure were not processed, even though they contained sufficient information to identify the data subject and, where applicable, to proceed with the erasure of their data.

In its defense, the company argues, in its second set of observations, that only 12 requests (as opposed to the 7 initially cited by the company in its first set of observations) out of the 145 mentioned in the report were not granted. In this regard, it emphasizes, first, that 125 requests concerned candidates who were not shortlisted, whose data was automatically erased 60 days after receipt. It concludes that these 125 requests were moot with respect to the right to erasure, as this right had already been respected given the aforementioned deletion period. The company explains that during the pre-selection stage, an automated email was sent to this group of candidates informing them that their application had been rejected; this email erroneously stated that their data would be stored for two years, even though the actual storage period applied to them was 60 days. Second, the company argues that 8 requests involved special circumstances: Two individuals could not be identified; four individuals were former employees whose data was legally stored; one individual’s request became moot because it had been processed prior to the on-site inspection; and one request was more akin to a comment than a request for erasure. In general, the company emphasizes that it prioritized the actual processing of erasure requests over communicating with individuals, given the operational disorganization of its legal department, compounded by a surge in requests resulting from the erroneous informational email sent to candidates who were not shortlisted. The company emphasizes that in the overwhelming majority of cases covered by this violation, the only shortcoming was the failure to inform individuals, not an actual failure to perform the erasure of the data. It asserts, in any case, that it has corrected the alleged communication error since February 2025 by providing adequate information to unsolicited applicants who were not shortlisted.

In her response, the rapporteur notes that the company does not support its statements with any documentation or further details, particularly regarding the origin of the 60-day storage period, which it mentions for the first time only in response to the sanction report. Nor does it provide evidence of the actual deletion of data pertaining to the unselected applicants affected by the violation. However, assuming that this storage period was in fact applied by the company to the data of the unselected applicants, the rapporteur considers that, on the one hand, the violation still applies to some of the requests and, on the other hand, with regard to the remaining requests, the automatic deletion of data after a 60-day period did not exempt the company from informing the data subjects of the action taken in response to their requests, which it failed to do.

Next, regarding the 125 requests which, according to the company, were in practice granted through automatic deletion occurring 60 days after receipt of the application, the rapporteur emphasized that the company had only mentioned the existence of this storage period in its comments in response to the sanction report, that it was not formalized in any internal company document regarding personal data governance, and that the email sent to candidates not shortlisted did not mention a 60-day storage period, but rather a 2-year period.

The restricted panel takes note of the company’s statements, in which it maintains that the evidence in the file does not support a finding of a violation of Article 17 of the GDPR with respect to these 125 individuals. The alleged violation cited by the rapporteur regarding the provision of information to individuals will be examined below, in section 2.

Consequently, the panel considers that the failure to process 12 requests for erasure received in 2024, and the resulting lack of information, constitute a violation of the provisions of articles 12 and 17 of the GDPR.

Thus, while the violation remains established with respect to past events, issuing an injunction, as proposed by the rapporteur, no longer appears appropriate. 2 Regarding the failure to inform data subjects of the action taken in response to their request for erasure (Article 12 of the GDPR)

Legally, it follows from the provisions of Article 12, paragraphs 3 and 4 of the GDPR that, regardless of the action taken in response to a request to exercise rights, the controller must inform the data subject of those actions, either by confirming that the request has been granted or by explaining the reasons for not acting and reminding the data subject of their right to lodge a complaint with a SA and to seek judicial remedy.

In her response, the rapporteur also noted, with regard to the requests for erasure initially included in her report concerning the breach of Articles 12 and 17 of the GDPR examined above, that even if a 60-day storage period had indeed been automatically applied to the data of non-shortlisted candidates, the deletion of the data subjects’ data did not exempt the company from informing them of the action taken in response to their request, which it failed to do.

The Panel notes that, as previously stated, the fact that the data was actually erased has no bearing on the company’s obligation to inform the data subjects of the outcome of their request, whether it was granted or not—an obligation the company acknowledges it failed to fulfill.

Regarding the number of data subjects affected by this breach, the Panel notes that of the 265 data subjects who submitted a request for erasure in 2024, 166 were not informed of the outcome of their request. In fact, in addition to the 37 individuals initially identified in the sanction report, there were 129 individuals who submitted a request for erasure, regarding whom the company stated, for 125 of them, that the data had been deleted 60 days after receipt, and, for 4 of them, that certain data had to be stored in accordance with legal requirements and due to their status as former employees. The panel notes that the company provided the supervisory delegation with all individual files regarding requests for erasure submitted in 2024, as well as, where applicable, “the responses provided to them.” However, a review of the individual files of these 166 individuals revealed that none of the files contained an email in which the company had informed them of the outcome of their request, a fact which the company does not dispute.

The Panel considers that these facts constitute a violation of Article 12 of the GDPR.

In its final comments, the company states that, while it still had the data available to do so, it informed all data subjects affected by this violation of the outcome of their requests. For the vast majority of these individuals, this information was provided via an email sent on April 14, 2026; the remaining data subjects were informed, also by email, shortly before or shortly after that date. For the 12 individuals to whom this information could not be provided, the company cited valid reasons; in particular, the deletion of the data subject’s contact information, the failure to deliver the message (full inbox or address not found), or the inability to identify the data subject. Consequently, while the violation remains established with respect to past events, issuing an injunction on this point no longer appears necessary. 3 Regarding the delay in the responses provided to the data subjects concerning the follow-up to their requests to exercise their rights (Article 12 of the GDPR)

Under the law, in accordance with Article 12, paragraphs 3 and 4 of the GDPR, the controller is required to respond to requests to exercise rights submitted to it within one month. In the event of an extension of this deadline under the conditions set forth in paragraph 3, as well as in cases where the data subject’s request is not granted, the data subject must receive information tailored to their situation within one month of the receipt of their request.

In its defense, the company emphasizes that 10 of these requests for erasure concerned candidates who had not been shortlisted, whose data had been automatically deleted 60 days after they submitted their applications. Thus, while it acknowledges that these individuals were indeed notified late, the company considers that the right to erasure had, in practice, already been respected for nearly one-third of them. It further argues that one of these requests, dated 2025, falls outside the time frame of the allegations in the report, which pertains to requests received in 2024. The company attributes these delays to the difficult operational context it faced in 2024, marked by a temporary disruption in its legal department, which resulted in the need to prioritize processing requests over notifying individuals.

It further notes that the company does not dispute the violation and that the case file does not indicate that the company informed the individuals who submitted these requests of any difficulties that would have justified an extension of the one-month deadline set forth in paragraph 3 of article 12 of the GDPR. Consequently, the company should have informed these individuals of the actions taken within the one-month period provided for in that provision.

However, the panel notes that it is evident from the individual files on requests to exercise rights, as well as from the information in the table tracking requests for erasure, that there were 26 requests for erasure (and not 27—given what is mentioned in paragraph 53 above) that resulted in the data subjects being informed with delays of up to more than five to six months. Furthermore, an access request for data received by the company in 2024 resulted in the data subject being informed of the action taken in response more than one year late.

The Panel notes that the obligation to respond to requests to exercise rights received by a controller within one month of receipt constitutes an independent obligation that cannot be offset by the automatic erasure of data. Therefore, the fact that the data of 10 of the 26 data subjects was subjected to an erasure 60 days after receipt, as indicated by the company, did not exempt the company from responding to these requests, which it did belatedly for all 26 requests.

The Panel finds that these facts constitute a violation of Article 12 of the GDPR, insofar as 26 individuals who submitted a request for erasure and one individual who submitted an access request were informed of the measures taken in response to their requests after the one-month deadline provided for in that article. D. Regarding the breach of the obligation of transparency and information with respect to employees

Under the law, Article 13(1) of the GDPR requires the controller to provide the data subject, at the time the data is collected from them, various pieces of information, including, in particular, the controller’s identity and contact details, the processing purposes, the legal basis for the processing, the recipients or categories of recipients of the data, and whether the controller intends to carry out a data transfer to a third party.

Article 13(2) of the GDPR further requires, to ensure fair and transparent processing of personal data, that individuals be informed of the data storage period, the rights they enjoy, the right to withdraw consent at any time, and the right to lodge a complaint with a SA.

In her report, the rapporteur noted that the information provided to the company’s new employees in the “certificate regarding the processing of personal data” given to them concerning the processing of their data—particularly for personnel management purposes—did not include any mention of the data storage period. In light of the documentation and explanations provided by the company in its defense, the rapporteur, in her response and during the hearing, indicated that she was withdrawing this allegation of non-compliance.

Article 20-IV of Law No. 78-17 of January 6, 1978, as amended, provides that: “where the controller or its processor fails to comply with the obligations arising from Regulation (EU) 2016/679 of April 27, 2016, or from this Act, the President of the National Commission for Information Technology and Civil Liberties may […] refer the matter to the Commission’s select panel for the purpose of issuing, following an adversarial proceeding, one or more of the following measures: […] An order to bring the processing into compliance with the obligations arising from Regulation (EU) 2016/679 of April 27, 2016, or this Act, or to comply with requests submitted by the data subject to exercise their rights, which may be accompanied, except in cases where the processing is carried out by the State, a periodic penalty payment, the amount of which may not exceed 100,000 euros per day of delay as of the date set by the panel; […] 7° Except in cases where the processing is carried out by the State, an administrative fine not exceeding 10 million euros or, in the case of an enterprise, 2 percent of its total worldwide annual revenue for the previous fiscal year, whichever is higher. In the cases referred to in paragraphs 5 and 6 of article 83 of Regulation (EU) 2016/679 of April 27, 2016, these limits are increased to 20 million euros and 4% of said revenue, respectively. In determining the amount of the fine, the Chamber of Limited Composition takes into account the criteria specified in the same article 83.” Article 83 of the GDPR, as referred to in Article 20, paragraph IV, of the French Data Protection Act, provides that: “Each SA shall ensure that administrative fines imposed pursuant to this article for infringements of this Regulation referred to in paragraphs 4, 5, and 6 are, in each case, effective, proportionate, and dissuasive,” before specifying the factors to be taken into account when deciding whether to impose an administrative fine and when determining the amount of such a fine.

Finally, article 22, paragraph 2, of the Data Protection Act provides that “the restricted panel may make public the measures it takes.” A. On the Imposition of an Administrative Fine and Its Amount

The Panel notes that the relevant criteria set forth in Article 83 of the GDPR must be examined to determine whether an administrative fine should be imposed on the company and, if so, to determine its amount. 1 On the Imposition of an Administrative Fine

The rapporteur proposes that the restricted panel impose an administrative fine on the company for the violations of Articles 12 and 17 of the GDPR.

In its defense, the company argues that the severity of the violations is limited, since the majority of the requests for erasure identified by the rapporteur as having not been processed—in violation of Article 17 of the GDPR— concerned data subjects whose data had already been deleted after a 60-day period. It believes that this circumstance must be taken into account and that the remaining violations under Article 12 of the GDPR primarily concern the absence or insufficiency of information provided to the data subjects regarding the follow-up to their requests. Furthermore, the company emphasizes its cooperation with the CNIL throughout the proceedings, the fact that the duration of the violations is limited to the year 2024, as well as its proactive approach to implementing corrective measures.

The Chamber of the General Court notes that, in assessing whether to impose a fine, it must take into account the criteria set forth in Article 83 of the GDPR, such as the nature, gravity, and duration of the violation, the scope or processing purpose, the number of data subjects affected, the measures taken by the controller to mitigate the harm suffered by the data subjects, whether the violation was committed through negligence, the degree of cooperation with the SA, the categories of data concerned, and the level of harm suffered by the data subjects.

First, the Chamber considers that the criterion set forth in article 83, paragraph 2 (a) of the GDPR regarding the nature, gravity, and duration of the breach, taking into account the nature, scope, or purpose of the processing operations in question, as well as the number of data subjects affected.

The Panel notes, first of all, that breaches of Articles 12 and 17 of the GDPR fall within the scope of Article 83(5) of the GDPR and are thus subject to the highest fine provided for by the European legislature, namely 20 million euros or, in the case of an enterprise, up to 4 percent of its annual global turnover—a provision that in itself attests to the seriousness of the violations in question.

The Chamber of the General Court emphasizes that the company’s violations concern the fundamental principles of personal data protection and infringe upon individuals’ rights. It emphasizes that respect for the right to erasure and the principle of transparency are essential to enabling individuals to retain control over their data, by ensuring that such data is not stored longer than necessary and, in any event, by informing them of how their data is processed when they submit a request to that effect.

The Panel wishes to emphasize the significant number of data subjects affected by the identified violations regarding the exercise of the right to erasure. Indeed, even after the company definitively stabilized the number of requests that were erased after a 60-day period, a total of 204 requests for erasure were not properly processed in 2024 alone, either because these requests were not processed (12), because the data subjects were not kept informed of the outcome of their request (166), or because they were informed after the deadline (26). In total, therefore, more than three-quarters of the requests to exercise the right to erasure received in 2024 were not processed or were not processed satisfactorily by EXTIA.

The Panel of Three considers that the fact that most of the data for which individuals requested erasure had, in practice, already been deleted has no bearing on the existence of violations, the scope of which varies only in part. Indeed, on the one hand, for virtually all of these requests (namely 129 out of 133), a failure to provide information to the data subjects remains established. On the other hand, the panel wishes to emphasize that the automatic deletion of the data of 125 candidates who were not shortlisted after a 60-day period, as put forward by the company in an attempt to minimize its accountability, cannot obscure the fact that none of these 125 requests was, strictly speaking, reviewed by the company at the time of receipt.

Finally, as the rapporteur noted, the failures to comply with the obligation to respond to requests to exercise rights were ongoing. In fact, the company had already received two formal notices from the CNIL in April and June 2024 reminding it of its obligations regarding the processing of requests to exercise rights. However, as of the date of the on-site inspection, April 10, 2025, more than three-quarters of the requests to exercise rights received in 2024 had not been processed correctly, or had not been processed at all. This situation persisted—at the very least with regard to the failure to inform data subjects about the follow-up to their requests—as of the date the penalty report was sent, March 12, 2026. the panel notes that, while the company claims to have implemented, as of December 2024, a new organizational structure designed to enable it to respond to requests to exercise rights within the time limits set by the GDPR, this measure had not proven effective as of the date of the inspection. It further notes that the vast majority of individuals who submitted a request for erasure in 2024 and were identified by the rapporteur as not having been informed of the outcome of their request were not so informed only after the penalty report was served.

Second, the panel considers that the criterion set forth in Article 83(2)(b) of the GDPR—regarding whether the violation was committed intentionally or through negligence—should be taken into account.

The panel emphasizes that the number of data subjects affected by the failures to address requests to exercise rights reveals a particular degree of negligence on the part of the company. It notes that more than 200 requests resulted in violations of the GDPR, whether due to delays in processing, a failure to inform the data subjects, or a complete failure to process the requests.

However, as noted, the company had already been issued two formal warnings regarding its obligations to comply with requests to exercise data subject rights. During the hearing before the panel, the company acknowledged that it had been slow to respond to a situation that had already prompted two formal warnings from the CNIL in 2024.

Third, regarding the specific cooperation the company claims to have demonstrated with the CNIL, the panel notes that the company provided essential information for the investigation belatedly—as this information was submitted only at the stage of its defense brief, with the aim of challenging the violations identified in the report—and that some of this information was insufficiently substantiated. In this regard, the panel reiterates, as noted by the rapporteur, that article 5, paragraph 2 of the GDPR establishes a principle of accountability for the controller, under which the latter must be able to demonstrate compliance with the principle of transparency, which includes, in particular, informing data subjects of the procedures for exercising their rights (Recital 39 of the GDPR). It also notes that the figures provided by the company differed between its initial and subsequent submissions; this discrepancy raises doubts as to the thoroughness with which the company verified, upon receipt of the penalty report, the status of the requests related to the violations identified in the report. The panel further emphasizes that it was in its comments of June 8, 2026, that the company demonstrated that it had adopted certain compliance measures, such as sending emails informing the data subjects affected by the failure to provide information of the action taken regarding their request, which was filed in 2024.

Accordingly, the panel finds that the company has not demonstrated a particular level of cooperation with the CNIL that would warrant consideration as a mitigating circumstance, bearing in mind that, pursuant to Article 31 of the GDPR, the controller “shall cooperate with the SA, at its request, in the performance of its tasks.” In this regard, Guidelines 04/2022 of the European Data Protection Board on the calculation of administrative fines under the GDPR state that the controller “is subject to a general obligation to cooperate under Article 31 of the GDPR (…). It should therefore be considered that the ordinary duty to cooperate is mandatory and that this factor must therefore be deemed neutral (and not considered a mitigating factor)” (paragraph 96).

Finally, while taking into account that the company has, to date, adopted measures to ensure its compliance, the restricted panel notes that these actions were taken, for the most part, in response to the initiation of sanction proceedings and that, in any event, they do not exempt the company from accountability for past conduct. All of these factors justify the imposition of a financial sanction.

Consequently, the panel considers that an administrative fine should be imposed for the violations of Articles 12 and 17 of the GDPR. 2 Regarding the amount of the administrative fine

In its defense, the company requests a substantial reduction in the proposed fine, taking into account, in particular, the dismissal of the violation of Article 13 of the GDPR, the “significant evolution of the allegation based on Article 17 of the GDPR,” its cooperation with the CNIL, its proactive efforts to implement corrective measures, and its actual profit for the year 2024.

The Chamber notes that the violations relating to articles 12 and 17 of the GDPR constitute violations of fundamental principles of the GDPR, which may, pursuant to Article 83 of the GDPR, an administrative fine of up to 20,000,000 euros or up to 4% of annual turnover, whichever is higher.

It then notes that the company’s financial situation must also be taken into account. In this regard, it points out that EXTIA’s revenue amounted to […] with a net income of […] in 2024, […] with a net income of […] in 2023, and that its preliminary revenue for fiscal year 2025 amounts to […]. The panel notes that the company reports significantly higher revenue figures on its website for the years 2023 […], 2024, and 2025 […]. When questioned on this point during the hearing before the panel, the company clarified that the revenue figures reported on its website corresponded to EXTIA’s global revenue, and that those reported in the financial statements submitted to the CNIL corresponded to EXTIA’s revenue in France. Finally, it notes that administrative fines must be dissuasive and proportionate.

Thus, in light of the company’s accountability, its financial capacity, and the relevant criteria of paragraph 83 of the GDPR mentioned above, the panel considers that an administrative fine in the amount of three hundred thousand (300,000) euros to penalize the violations of articles 12 and 17 of the GDPR appears to be deterrent and proportionate.

In her report, the rapporteur proposed that the panel issue an injunction against the company requiring it to bring the processing operations in question into compliance with the provisions of articles 12, 13, and 17 of the GDPR, accompanied by a periodic penalty payment.

In its final submissions, the company provided supporting documentation demonstrating that the data of the data subjects affected by the violations had been deleted and that they had been informed of the action taken in response to their requests, where materially possible.

In the letter informing the company of the conclusion of the investigation, and subsequently during the hearing on July 2, 2026, the rapporteur clarified that, in light of the measures EXTIA claims to have implemented, she considers that there is no longer any need to seek the issuance of an injunction under articles 12 and 17 of the GDPR. Furthermore, since the rapporteur confirmed the withdrawal of the alleged violation of Article 13 of the GDPR in her response and during the hearing, and since no such violation has been established, there is no basis for issuing an injunction under article 13 of the GDPR.

The panel notes that the violations found concern a very large number of individuals relative to the number of requests for erasure received in 2024, and that the automatic deletion of certain applicants’ data did not alter the total number of data subjects affected by violations regarding the exercise of their rights. The panel also recalls, as noted by the rapporteur, that the company had already been reminded of its legal obligations by the CNIL without taking the necessary corrective actions.

In light of these factors, the Select Panel considers that a measure requiring public disclosure is warranted. It finds that this measure appears proportionate, given that the decision will no longer identify the company by name after a period of two years from its publication. FOR THESE REASONS The CNIL’s panel, after deliberation, decides to: - impose on the company EXTIA, an administrative fine in the amount of three hundred thousand (300,000) euros for violations of articles 12 and 17 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016; - publish its decision on the CNIL website and the Légifrance website, in a form that will no longer allow the company to be identified by name two years after its publication. The President Philippe-Pierre CABOURDIN This decision may be appealed to the Council of State within two months of its notification.