Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUR
France's data protection authority, the CNIL, fined IT and engineering firm EXTIA €300,000 following complaints from former employees about violations of transparency requirements and the right to erasure under GDPR. The July 2026 decision found the company failed to respect individuals' rights over their personal data.
Why this matters: When you leave a job, you have a legal right to ask a company to delete your data. EXTIA apparently made that harder than it should be. Multiple former employees had to complain to a regulator just to get basic answers. That is the problem this fine is addressing. The GDPR rights on paper only matter if companies actually honor them without a fight. A €300,000 penalty is a signal that ignoring erasure requests is not a low-risk choice, even for mid-sized firms.
Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.