The Commission Nationale de l'Informatique et des Libertés (CNIL), France's data protection authority, has imposed a fine of €300,000 on recruitment firm EXTIA over failures to respect the rights of individuals whose personal data the company processed.
The European Data Protection Board reported the sanction as part of its regular round-up of enforcement action taken by national supervisory authorities across the EU. Details of the specific rights breaches were not set out in the published summary.
The decision concerns data protection obligations under the General Data Protection Regulation rather than the EU AI Act directly. However, it is a reminder that organisations using automated or algorithm-assisted tools in recruitment and human resources processes remain subject to overlapping data protection and, increasingly, AI governance requirements.
Recruitment is an area the EU AI Act treats with particular attention: AI systems used for recruitment or selection of natural persons, including for placing targeted job advertisements, screening or filtering applications, and evaluating candidates, are listed among the high-risk use cases in Annex III.
For organisations deploying AI in HR and recruitment contexts, this enforcement action is a useful signal that regulators are actively scrutinising how individuals' rights are handled throughout the employment lifecycle. As a compliance matter, this reinforces the case for aligning data subject rights processes with the broader documentation, transparency and human oversight obligations that apply to high-risk AI systems under the EU AI Act.
Organisations preparing for the EU AI Act's obligations on high-risk systems should treat data protection compliance and AI governance as closely linked workstreams, rather than parallel exercises, particularly where recruitment or other high-risk use cases are involved.