Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUR
NL-context Zorginstellingen die persoonsgegevens van kandidaten of ex‑medewerkers bewaren, moeten direct en volledig voldoen aan verzoeken tot gegevensverwijdering; falen leidt tot zware boetes onder de AVG.
Samenvatting
Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUR. Background information Date of final decision: 21 July 2026 National case Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 17 (Right to erasure ‘right to be forgotten’) Decision: Administrative fine Key words: Data subject rights Summary of the Decision Origin of the case EXTIA, which specialises in IT and engineering, recruits consultants for various technical projects from its client companies. In 2024, the French Data Protection Authority (CNIL) received several complaints from former employees or candidates, relating to difficulties encountered in exercising their right to erasure or ‘right to be forgotten’. With a view to investigating these complaints, and also in the context of the Coordinated Enforcement Framework action on the ‘Right to erasure’ launched on the initiative of the European Data Protection Board in 2025, an audit of EXTIA was carried out in April 2025. It identified breaches of several obligations under the GDPR regarding transparency and respect for individuals’ rights. Of the 265 requests for erasure received by the company in 2024, the majority of which came from candidates and, occasionally, former employees, more than three quarters had not been dealt with or had not been dealt with satisfactorily. Key Findings Failure to process erasure requests (Articles 12 and 17 GDPR) The CNIL’s restricted committee – the body responsible for issuing sanctions – noted that 12 requests for erasure received by the company in 2024 had not been processed. It considered that that failure had adversely affected the rights of those persons, including the right to retain control over their data. Failure to inform individuals of the action taken on their reques...
Waarom dit ertoe doet
Nieuwe regelgeving heeft directe gevolgen voor zorginstellingen die AI-systemen inzetten of plannen in te zetten.
Context (AI-duiding)
Klik op “Toon context” om AI-duiding op te halen.
Scores
De mate waarin dit signaal de Nederlandse gezondheidszorg kan beïnvloeden (1 = minimaal, 5 = transformatief).
Hoe snel actie of aandacht nodig is (1 = kan wachten, 5 = onmiddellijke aandacht vereist).
De mate van onzekerheid over de uitkomst of timing (1 = zeer voorspelbaar, 5 = zeer onzeker).
Tags
Bronnen
- Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUREuropean Data Protection Board (EDPB) —
Relevant voor
Pipeline versie: 0.2.0 | Gegenereerd door: pipeline