The National Commission on Informatics and Liberty (CNIL) sanctioned EXTIA for failing to meet its obligations regarding the management of right to erasure requests, emphasizing that the effective deletion of data does not exempt the data controller from formally informing the data subjects of the outcome of their request.

Facts and Context

The French data protection authority (CNIL) issued a sanction decision against EXTIA, including a fine of €300,000, for breaches related to the respect of individuals' rights, particularly the right to erasure.

The case originated from several complaints by former employees and candidates concerning difficulties in exercising their right to erasure, investigated as part of a coordinated action by the European Data Protection Board (EDPB).

Grounds for the Decision

• Obligation to process erasure requests (Article 17 of the GDPR): The authority found that out of 265 requests received in 2024, 12 had not been processed. It considered this inaction a violation of the fundamental right of individuals to maintain control over their personal data. The rectification made by the company during the procedure did not erase the initial breach.
• Obligation of information and transparency on the outcome of a request (Article 12 of the GDPR): The restricted formation noted that 166 individuals received no information about the processing of their request and 27 others received it beyond the legal one-month deadline. The authority formally rejected the company's argument that automatic deletion of some candidates' data exempted it from this obligation, recalling that each requester must be explicitly informed of the outcome of their request.

Authority's Decision

Consequently, the authority imposed a fine of €300,000 on EXTIA.

Lessons Learned

This decision reminds that:

• The effective deletion of data, including by an automatic process, does not exempt the data controller from the obligation to formally inform the data subject of the outcome of their erasure request within the prescribed time limits.
• Failure to process a request to exercise a right and failure to inform the data subject of the outcome constitute two distinct violations of the GDPR, which may be cumulatively sanctioned.
• Previous warnings and the high number of individuals affected by a breach of data subject rights are factors taken into account when determining the amount of the sanction.