← All topics
Governance domain
AI incidents: data protection
Headlights has documented 44 AI incidents that raise questions of data protection, 19% of the library, from 2020 to 2026. The behaviours most often in the record are rules-behaviour gap (13), overconfidence (8), concealment (3). Most are from the United States (13), Australia (9), Italy (4).
44 incidents, newest first
HD-INC-234Ireland's Regulator Found No Lawful Basis for Public Services Card Facial MatchingIreland · 2025HD-INC-226Meta's Muse Agent Shared a Seller's Address on Marketplace Under an Always Allow SettingUnited States · 2026HD-INC-224Austria's Privacy Regulator Held a Credit Bureau Made an Automated Decision on ElectricityAustria · 2025HD-INC-218Italy Fined an Energy Supplier Whose Credit Score Refused Contracts Without ExplanationItaly · 2026HD-INC-217OpenAI Agents Reached Two NSW Systems, a Crime Data Tool and a Fire Data ApplicationAustralia · 2026HD-INC-216An OpenAI Model Got Non-Public Access to a Medicare Statistics Service, OpenAI SaidAustralia · 2026HD-INC-213BC's Privacy Commissioner Ordered a City to Stop Its Licence Plate Recognition CamerasCanada · 2026HD-INC-212France's Top Administrative Court Cut Amazon's Warehouse Data Fine to 15 Million EurosFrance · 2025HD-INC-209A Spanish Court Let a Worker Quit With Compensation Over Facial Recognition ClockingSpain · 2026HD-INC-208Dutch Auditors Found Police Did Not Track What Their Number Plate Algorithm Led ToNetherlands · 2026HD-INC-203An Online University Required Facial Recognition for Classes, and Italy Fined ItItaly · 2024HD-INC-200Four Claude Models Reached Real Third-Party Systems After Test Setups Were Left OnlineUnited States · 2026HD-INC-196An Otter.ai Transcription Tool Joined Hospital Rounds Through a Former Doctor's Old InviteCanada · 2024HD-INC-195AI Research Agents Reached Another Company's Production SystemsUnited States · 2026HD-INC-184EU court rules automated credit decisions must be explained in a way people can understandAustria · 2025HD-INC-182An Italian regulator warned that workplace stress reports derived from chat analysis could unlawfully reach employers, even in aggregate formItaly · 2026HD-INC-178Canadian privacy regulators found OpenAI had not validated the general accuracy of personal information generated about peopleCanada · 2026HD-INC-172Ireland's data protection regulator opened an inquiry into an airline's use of facial recognition to verify passengers who had booked through third party websites or online travel agentsIreland · 2024HD-INC-162A reporter found nearly 4,500 shared ChatGPT conversations in Google's index through an ordinary site search, and OpenAI withdrew the discoverability setting the following dayUnited States · 2025HD-INC-161Meta's standalone AI app carried a Discover feed that reporters found was publishing users' conversations, in the cases they documented alongside a linked Facebook or Instagram profile, and the company added a warning screen after the reportingUnited States · 2025HD-INC-159A compromised build tool launched developers' own AI coding assistants with their permission checks disabled and used them to map sensitive files on the machineUnited States / global · 2025HD-INC-156Greece's data protection authority fined the Migration Ministry 175,000 euros after finding that the impact assessments for the camera, behavioural analytics, drone and fingerprint systems at five island reception centres were substantially incompleteGreece · 2024HD-INC-127Amnesty International reported that Denmark's automated welfare fraud system ran up to sixty algorithms over millions of people, using data like citizenship to flag migrants, disabled and low-income claimants for investigationDenmark · 2024HD-INC-123South Korea's privacy regulator fined Kakao Pay after finding it had sent about 40 million users' data to Alipay without their consent, where it was used to build a scoring model, and it ordered the model deletedSouth Korea · 2025HD-INC-120Security researchers showed that a hidden instruction on a web page could make Perplexity's AI browser hand over a user's email and one-time login code to an attacker, enough to steal the account, and Perplexity's first fix did not close the holeUnited States · 2025HD-INC-114Security researchers showed that a hidden instruction placed in a Salesforce sales form could make its AI agent send customer records to a web address the attacker controlled, through a lapsed Salesforce domain that was still trustedUnited States · 2025HD-INC-104LinkedIn began using members' data to train AI by default, and paused it for the UK and Europe after the privacy regulator stepped inUnited States · 2024HD-INC-103Los Angeles schools committed about six million dollars to an AI chatbot showcased in spring, and its vendor had collapsed by JulyUnited States · 2024HD-INC-096Australia's federal police trialled Clearview's face-search tool on Australians without a privacy check, and the regulator found it breached privacy lawAustralia · 2021HD-INC-091Uber cut drivers off for alleged fraud by algorithm, and an Amsterdam court found the human review was not much more than a symbolic actNetherlands · 2023HD-INC-089DeepSeek left a database open on the internet with more than a million log lines, including users' chat history and secret keysChina · 2025HD-INC-082Flight Centre handed developers at a hackathon a dataset with thousands of customers' passport and credit card details, and the privacy regulator found it broke the lawAustralia · 2020HD-INC-071Italy's privacy regulator fined OpenAI EUR 15 million over ChatGPT, and a court later threw out the fine without deciding whether the conduct was lawfulItaly · 2024HD-INC-066A child protection worker used ChatGPT on a Children's Court report, and the regulator found it disclosed a child's details and understated riskAustralia · 2024HD-INC-063'EchoLeak': one crafted email could make Microsoft 365 Copilot leak a company's internal data, no click requiredUnited States · 2025HD-INC-060South Korea's 'Lee Luda' chatbot was trained on billions of real chat messages without consent, then spat out slurs and exposed users' personal dataSouth Korea · 2021HD-INC-0587-Eleven scanned the faces of customers filling in feedback surveys at 700 stores, and Australia's privacy regulator ordered the faceprints destroyedAustralia · 2021HD-INC-048Rite Aid face-scanned shoppers for years, generated thousands of false matches, and the FTC banned it from facial recognition for five yearsUnited States · 2023HD-INC-044A caching bug let ChatGPT users see other people's chat titles and some payment detailsUnited States · 2023HD-INC-028Samsung engineers pasted confidential source code into ChatGPT three times in twenty days, and the company could not get it backSouth Korea · 2023HD-INC-027McDonald's AI Hiring Bot Exposed Millions of Applicants' DetailsUnited States · 2025HD-INC-023Clearview AI Built a Face Search Engine From Billions of Scraped Photos Without ConsentAustralia · 2021HD-INC-022Bunnings Scanned Shoppers' Faces Without Telling Them, and Won Only Half Its AppealAustralia · 2024HD-INC-021Kmart Scanned Shoppers' Faces in 28 Stores, and the Privacy Commissioner Found It UnlawfulAustralia · 2025
Related topics
- Technology & software 14
- Retail, hospitality & travel 7
- Consumer AI 6
- Rules-behaviour gap 13
- Overconfidence 8
- Concealment 3
- Normalisation of deviance 3
- United States 13
- Australia 9
- Italy 4
Cite this page: Harris, E. (2026). AI incidents: data protection. Headlights. https://useheadlights.com/topics/domain/data-protection/