Skip to main content
NOPE
Medium reported severity Regulatory Action

Victorian child protection worker put a family's information into ChatGPT to draft a court report that minimised risk to the child, regulator finds

Victoria's Information Commissioner (OVIC) found in a report published on 24 September 2024 that a child protection worker at the Department of Families, Fairness and Housing (DFFH) used ChatGPT in or around September 2023 to draft a Protection Application Report submitted to the Children's Court about a young child. On the balance of probabilities, OVIC found the worker entered personal information, including names, about the child, mother, father and carer, disclosing it to OpenAI; the worker admitted using ChatGPT but denied entering personal information. OVIC found generated content in the report described a doll that the father had reportedly used for sexual purposes as a parental strength ('age-appropriate toys'), downplaying the risk to the child, although the court's and the department's decisions did not change. The report was withdrawn and replaced, and the mother, father and carer described anxiety when told of the disclosure. OVIC found serious breaches of two privacy principles and issued a compliance notice requiring DFFH to ban and block generative AI text tools for child protection staff until November 2026; DFFH accepted the breach findings.

AI system
ChatGPT
OpenAI
Occurred
Sept 2023
Reported
24 September 2024
Event location
Australia
What the AI did
Received personal information about the person · Made a claim about the person
Reported harm
Other Material HarmPsychological Distress
Whose AI use
An institution’s AI use
Setting
Privacy · Public services · Justice
Evidence
AI involvement supported · Causal attribution supported · 2 sources, 1 underlying account
6 claims: 5 documented, 1 reported. 5 open questions
People reported harmed
At least 4 people

AI system as recorded: ChatGPT (OpenAI), used through its website by a child protection worker of Victoria's Department of Families, Fairness and Housing to draft a court report, without departmental authorisation (per OVIC's investigation report)

What Happened

The Office of the Victorian Information Commissioner (OVIC) published its investigation report on 24 September 2024. According to the report, DFFH reported a privacy incident to OVIC in December 2023 after a department legal representative, reviewing a Protection Application Report on the day of a further Children's Court hearing, raised concerns about its unusual language and the adequacy of its risk assessment and suspected it had been drafted with ChatGPT. The case concerned a young child whose parents had been charged in relation to sexual offences not committed against the child; the child had been removed from the parents' care under interim orders.

OVIC's compliance notice states that in or around September 2023 the worker used ChatGPT when drafting the report, which was later submitted in the Children's Court proceedings. The worker admitted to DFFH using ChatGPT for this report and on other occasions, to save time and to present work more professionally, but denied entering personal information. Colleagues said the worker had demonstrated the tool by entering client names. OVIC found on the balance of probabilities that the worker entered personal information, including names, about the mother, father, carer and child, which disclosed it to OpenAI and released it from the department's control. DFFH's response says it is not possible to confirm definitively that personal information was entered.

OVIC found that ChatGPT generated inaccurate content in the report. The report first referred to a doll that the father had reportedly used for sexual purposes, then cited the same toy as a strength of the parents' care ('age-appropriate toys'). OVIC said this downplayed the severity of the actual or potential harm to the child. The deficiencies did not change the decisions of Child Protection or the court. DFFH arranged with the court to withdraw the report and submit a replacement, and notified the affected parties; the mother, father and carer described feelings of anxiety and being overwhelmed when told their information had been disclosed.

A DFFH review of 796 cases handled by the worker's unit over 12 months found 100 cases with indicators that ChatGPT may have been used in child protection documents, none with the same potential impact on risk assessment, and nearly 900 DFFH employees accessed the ChatGPT website between July and December 2023. OVIC found serious contraventions of two privacy principles and ordered DFFH to ban and block generative AI text tools for child protection staff until 5 November 2026.

Reported harm

OVIC found that personal information about a child, the mother, father and carer was entered into ChatGPT and disclosed to OpenAI, and that ChatGPT-generated content in a court report downplayed the risk to the child; the mother, father and carer described anxiety when told, according to OVIC's report.

Outcome

Resolved

OVIC found that DFFH contravened Information Privacy Principles 3.1 (data quality) and 4.1 (data security) and that the contraventions were serious, and issued a compliance notice with six specified actions: a direction to child protection staff not to use web-based or external API-based generative AI text tools, IP or DNS blocking of named tools including ChatGPT, Claude, Meta AI, Gemini and Copilot, scanning for similar new tools, controls on Microsoft 365 Copilot, and monitoring reports, with the blocking and Copilot controls maintained until 5 November 2026. DFFH's Secretary accepted the breach findings in a letter of 18 September 2024 and said the worker no longer works in the department.

What remains unknown

  • Exactly what text the worker entered into ChatGPT; neither DFFH nor OVIC could see the prompts, and the input of personal information rests on a balance-of-probabilities finding.
  • The exact date of the ChatGPT use (the compliance notice says 'in or around September 2023') and of the court hearing.
  • Whether OpenAI retained or used the information entered.
  • Which people were affected in the 100 other cases with indicators of ChatGPT use, and whether their information was entered.
  • How DFFH has complied with the compliance notice since its first monitoring reports.

What the evidence supports

AI involvement: supported. OVIC's report finds that ChatGPT received personal information about the child, mother, father and carer that the worker typed in, which disclosed it to OpenAI, and that ChatGPT generated report text inaccurately describing the parents' care of the child (the doll passage), which went into a report submitted to the Children's Court and downplayed the risk to the child. The finding rests on indicators in the report text, the worker's admission of ChatGPT use and colleagues' accounts; the input of personal information was found on the balance of probabilities and the worker denied it.

6 claims: 5 documented, 1 reported. What the statuses mean

Documented OVIC's investigation report, published in September 2024, found that DFFH contravened Information Privacy Principles 3.1 and 4.1 over a child protection worker's use of ChatGPT, that the contraventions were serious, and issued a compliance notice requiring DFFH to direct child protection staff not to use web-based generative AI text tools and to block them until 5 November 2026.

Causal attribution. The regulator's own report and compliance notice establish its findings and orders.

  • ovic.vic.gov.au(opens in new tab) supports · English
    Report: 'The Deputy Commissioner therefore found that DFFH contravened both IPP 3.1 and IPP 4.1 and determined that the contraventions were “serious”'; 'Issue a direction to Child Protection staff setting out that they are not to use any web-based or external Application Programming Interface (API)-based GenAI text tools (such as ChatGPT) as part of their official duties'; 'This action must be implemented by 5 November 2024 and maintained until 5 November 2026'.
  • theguardian.com(opens in new tab) supports · English
    'The regulator issued orders to the department, including blocking IP and domains for a range of generative AI websites, including ChatGPT, Meta AI, Gemini and Copilot.'
Documented OVIC found that in or around September 2023 a DFFH child protection worker used ChatGPT when drafting a Protection Application Report that was submitted to the Children's Court in a case about a young child whose parents had been charged in relation to sexual offences; the worker admitted to DFFH using ChatGPT for the report.

Causal attribution. OVIC's finding, based on indicators in the report and the worker's admission to DFFH.

  • ovic.vic.gov.au(opens in new tab) supports · English
    Compliance notice: 'In or around September 2023, a Child Protection worker (CPW1) of the Organisation used'; 'ChatGPT, a web-based generative Artificial Intelligence (GenAI) tool, when drafting a Protection'. Report: 'The report had been submitted to the Children’s Court for a case concerning a young child whose parents had been charged in relation to sexual offences'; 'CPW1 admitted that they had used ChatGPT in drafting the report, but denied inputting personal information as part of this'.
Documented OVIC found on the balance of probabilities that the worker entered personal information, including names, about the child, mother, father and carer into ChatGPT, disclosing it to OpenAI; the worker denied entering personal information, and DFFH says this cannot be confirmed definitively.

Causal attribution. A regulator's finding on the balance of probabilities, contested by the worker's denial; organisations cannot see what staff typed into ChatGPT.

  • ovic.vic.gov.au(opens in new tab) supports · English
    Report: 'OVIC found, on the balance of probabilities, that CPW1 input personal information, including names'; 'By entering personal and sensitive information about the mother, father, carer, and child into ChatGPT, CPW1 also disclosed this information to OpenAI (the company which operates ChatGPT)'; DFFH response: 'it is not possible to definitively confirm that personal information has ever been entered into ChatGPT by the Child Protection Practitioner who no longer works in the department'.
  • theguardian.com(opens in new tab) supports · English
    'Ovic found that, on the balance of probabilities, the worker had entered in personal information.'
Documented OVIC's report attributes inaccurate content in the report to ChatGPT: having described a doll the father had reportedly used for sexual purposes, the report later cited the same toy as a parental strength ('age-appropriate toys'), which downplayed the risk to the child; the deficiencies did not change the decisions of Child Protection or the court.

Causal attribution. OVIC attributes the doll passage to ChatGPT from the content itself and the worker's admission of ChatGPT use.

  • ovic.vic.gov.au(opens in new tab) supports · English
    Report: 'First, the PA Report referenced how the child’s father used a particular toy, a doll, for sexual purposes.'; 'The report later referenced the same toy as a notable strength, in that the parents had provided the child with “age-appropriate toys”'; 'ChatGPT failed to properly understand the relevant context, and generated inappropriate and inaccurate content as a result'; 'these deficiencies in the report did not ultimately change the decision-making of either Child Protection or the Court in relation to the child'.
  • theguardian.com(opens in new tab) supports · English
    'But it also said the report did not change the decision-making of either the child protection agency or the court.'
Reported According to OVIC's report, DFFH arranged with the court for the report to be withdrawn and replaced and notified the affected parties; the mother, father and carer described feelings of anxiety and being overwhelmed when told their information had been disclosed.

Causal attribution. DFFH's account to OVIC; the family members' reactions are relayed by the regulator, not in their own words.

  • ovic.vic.gov.au(opens in new tab) supports · English
    Report: 'DFFH arranged with the Court for the PA Report to be withdrawn and a replacement one submitted. It also notified affected parties about the incident'; 'In the present case, the mother, father, and carer variously described feelings of anxiety and being overwhelmed when informed about their information being disclosed'.
Documented DFFH's Secretary accepted that a child protection practitioner had used ChatGPT without authorisation for a court report and that the department breached the two privacy principles, and the department said it no longer employs the worker.

Causal attribution. DFFH's own letter, annexed to the report.

  • ovic.vic.gov.au(opens in new tab) supports · English
    DFFH response, 18 September 2024: 'I accept that there was an unauthorized use of ChatGPT by a Child Protection Practitioner'; 'when developing a Protection Application Report for court'; 'the Child Protection Practitioner who no longer works in the department'.
  • theguardian.com(opens in new tab) supports · English
    'In response, the department said it accepted the findings and would work to implement the orders. It said it no longer employed the worker.'

Sources

2 sources inspected, from 1 underlying account. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

OVIC investigation report under s8C(2)(e) of the Privacy and Data Protection Act 2014 (Vic), September 2024, with the compliance notice (Annexure A) and DFFH's response letter of 18 September 2024 (Annexure B); the PDF (re-uploaded November 2024) was read in full on 2026-10-22 from ovic.vic.gov.au (HTTP 200); the report page gives 'Last updated 24 September 2024'. Applies to s1.

The Guardian (Australia), 26 September 2024, read in full on 2026-10-22 (HTTP 200). Its account comes from OVIC's report, so it shares that group. Its statement that the worker may have used ChatGPT in 100 cases does not match the report, which attributes the 100 cases to the worker's broader work unit; that statement is not relied on. Applies to s2.

Event countries: Australia. Affected-person countries: Australia. Court countries: Australia.

OVIC is Victoria's information regulator, DFFH is a Victorian government department, and the report says the affected child protection case went before the Children's Court, a Victorian court. The family's case was handled by the department in Victoria.

Reviewed for publication 2026-10-22: Published under the 2026-10-06 privacy clarification: a regulator's investigation report finds that a child protection worker entered a family's personal information into ChatGPT, without authorisation, and that ChatGPT-generated text minimising the risk to a child went into a court report. Relations: received_personal_information and made_claim_about. The case adds a statutory child protection setting, a court report and a compliance notice banning generative AI tools.

People described

A young child who was the subject of a Victorian child protection case, and the child's mother, father and carer, whose personal information OVIC found was entered into ChatGPT (none named)

People reported harmed in this case

At least 4 people

0 AI participants · 4 other people harmed

OVIC's report finds that personal and sensitive information about the mother, father, carer and child in this case was entered into ChatGPT (four people), and records that the mother, father and carer described anxiety when informed. OVIC says personal information had likely been entered in other cases too; those people are not counted. The worker, the court and DFFH staff are not counted.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Tags

#chatgpt#child-protection#court-report#privacy-regulator#unauthorised-ai-use#personal-information#victoria

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). Victorian child protection worker put a family's information into ChatGPT to draft a court report that minimised risk to the child, regulator finds. AI incidents. https://nope.net/incidents/2023-victoria-child-protection-worker-entered-family-information-into-chatgpt-for-court-report-regulator-finds

BibTeX

@misc{2023_victoria_child_protection_worker_entered_family_information_into_chatgpt_for_court_report_regulator_finds,
  title = {Victorian child protection worker put a family's information into ChatGPT to draft a court report that minimised risk to the child, regulator finds},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2023-victoria-child-protection-worker-entered-family-information-into-chatgpt-for-court-report-regulator-finds}
}

Related cases

Low ChatGPT

NSW Reconstruction Authority says a former temporary staff member uploaded 2031 Resilient Homes participants' personal data to ChatGPT without authorisation

The NSW Reconstruction Authority says that between 12 and 15 March 2025 a former temporary staff member (called a former contractor in its first notice) uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information, 10 columns and more than 12,000 rows, to ChatGPT, an AI platform the Authority had not authorised. The Authority disclosed the breach on 6 October 2025, estimating that up to 3000 people were affected, and later said external forensic analysis confirmed that 2031 people had some of their data uploaded, including names, contact details, addresses, dates of birth, sensitive personal and health information and limited financial commentary. It says no driver licence, Medicare, passport or Tax File Numbers were disclosed and that there is no evidence the data is publicly available or was accessed by a third party; whether OpenAI retained or used the data is not addressed. The Authority apologised, contacted affected people with ID Support NSW, offered to compensate the replacement of compromised identity documents and notified the NSW Privacy Commissioner. A program participant told the ABC the information was deeply personal and that they felt concerned. No misuse of the data is reported.

High ChatGPT (reported)

Eindhoven municipality says staff uploaded files with residents' youth-care and social-support data and applicants' CVs to public AI websites such as ChatGPT

The municipality of Eindhoven in the Netherlands told its council in an information letter shared on Thursday 18 December 2025 that a sample of staff data traffic from 23 September to 23 October 2025 showed files containing personal data of residents and employees had been sent to public AI websites such as ChatGPT, according to Omroep Brabant and Binnenlands Bestuur. The files included youth-care (Jeugdwet) documents, internal reports and CVs, mostly from departments that provide care and support to residents. According to Omroep Brabant's account of findings by the advisory firm Hooghiemstra & Partners, the youth-care documents held information about the mental and physical health of minor children, and social-support (WMO) documents and applicants' CVs were also entered. The municipality reported the breach to the Dutch Data Protection Authority on 23 October, blocked public AI websites and asked OpenAI to delete the files. The council says the scale cannot be determined because the data was kept for only 30 days, so it cannot inform those affected, and that the risk of misuse is limited but cannot be ruled out. A spokesperson said OpenAI had not yet replied.

Medium ChatGPT

Texas health plan says an employee uploaded a file of members' personal and prescription data to ChatGPT from a home network, against its policy

Community First Health Plans, a nonprofit health plan in San Antonio, Texas, said in a 29 June 2026 release that on the evening of 29 April 2026 one of its employees uploaded a file containing personal information of some members to ChatGPT from a home computer network, circumventing the plan's firewall safeguards and violating its policy. The plan says it does not use ChatGPT and that its systems detected the violation and alerted its IT department. According to the release, the file may have included members' names, addresses, dates of birth, member identification numbers and prescription drug information. The next morning the plan revoked the employee's access, directed and verified deletion of the data from the employee's ChatGPT account, asked OpenAI to delete any related data, and ended its relationship with the employee. It notified affected members and federal and state agencies, offered 12 months of identity monitoring and says it is not aware of any misuse. The release gives no number of affected members.

Low ChatGPT

Adult ChatGPT Plus subscriber says the account was classified as a teen and restricted, and that OpenAI said profiling had to come first; first-person post

In a Reddit post of 11 October 2026, a ChatGPT Plus subscriber who says they are an adult (36, by the post's own account) writes that when OpenAI's age checks rolled out their account was classified as a teen account and put on a restricted account. The poster says they had earlier emailed OpenAI asking for verification options without ID or a photo, received a canned reply about the verification provider Persona, and on escalating to data protection was told they had to be profiled first. The poster says they then cancelled the subscription. OpenAI's Help Center says ChatGPT uses an age prediction system that reads account signals, automatically enables the teen experience when it predicts an account may belong to someone under 18, can get this wrong, and lets adults verify their age to remove it. The account is the poster's own and is not corroborated.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents