Skip to main content
NOPE
High reported severity

Eindhoven municipality says staff uploaded files with residents' youth-care and social-support data and applicants' CVs to public AI websites such as ChatGPT

The municipality of Eindhoven in the Netherlands told its council in an information letter shared on Thursday 18 December 2025 that a sample of staff data traffic from 23 September to 23 October 2025 showed files containing personal data of residents and employees had been sent to public AI websites such as ChatGPT, according to Omroep Brabant and Binnenlands Bestuur. The files included youth-care (Jeugdwet) documents, internal reports and CVs, mostly from departments that provide care and support to residents. According to Omroep Brabant's account of findings by the advisory firm Hooghiemstra & Partners, the youth-care documents held information about the mental and physical health of minor children, and social-support (WMO) documents and applicants' CVs were also entered. The municipality reported the breach to the Dutch Data Protection Authority on 23 October, blocked public AI websites and asked OpenAI to delete the files. The council says the scale cannot be determined because the data was kept for only 30 days, so it cannot inform those affected, and that the risk of misuse is limited but cannot be ruled out. A spokesperson said OpenAI had not yet replied.

AI system
ChatGPT (reported)
Occurred
23 Sept 2025 to 23 Oct 2025
Reported
18 December 2025
Event location
Netherlands
What the AI did
Received personal information about the person
Reported harm
Other Material Harm
Whose AI use
Someone else’s AI use
Setting
Public services · Health · Work · Privacy
Evidence
AI involvement reported · Causal attribution supported · 3 sources, 2 underlying accounts
4 claims: 4 reported. 5 open questions
People reported harmed
Not reliably quantifiable from the sources

AI system as recorded: Public AI websites, which the municipality's council letter, as reported, names with ChatGPT as the example; the municipality asked OpenAI to delete the uploaded files

What Happened

What the sample found. Omroep Brabant reports that, according to the council information letter, a sample of external data traffic found that files with personal data had been sent to public AI websites such as ChatGPT, including youth-care documents, internal reports and CVs, mostly from care and support departments. Binnenlands Bestuur reports the same sample period, 23 September to 23 October 2025.

What the files held. Omroep Brabant's second report, citing the advisory firm Hooghiemstra & Partners, says the youth-care documents contained information about the mental and physical health of minor children, and that social-support (WMO) documents, applicants' CVs and employees' reflection reports were also entered into the AI tool.

The response. The municipality reported the breach to the Autoriteit Persoonsgegevens on 23 October, stopped staff using public AI websites and, according to Binnenlands Bestuur, allows only Copilot inside its secured environment. It asked OpenAI to delete the files uploaded from Eindhoven and tightened monitoring of external data traffic. The council says the precise scale cannot be established because the data was kept for only 30 days, and that it therefore cannot inform the people concerned. It says individual data uploaded to an AI tool cannot easily be extracted by third parties, while not ruling the risk out. A spokesperson told Omroep Brabant that OpenAI had not yet responded.

Reported harm

According to the municipality's council letter as reported, staff uploaded files containing personal data of residents and employees, including youth-care documents about children's mental and physical health and social-support files, to public AI websites such as ChatGPT; the council says it cannot determine the scale or inform those affected.

Outcome

Ongoing

The municipality notified the Dutch Data Protection Authority on 23 October 2025, blocked public AI websites, asked OpenAI to delete the uploaded files and tightened monitoring. It says it cannot inform affected people. No reply from OpenAI and no regulator decision is reported in the inspected sources.

What remains unknown

  • How many residents, children, applicants and employees had data uploaded.
  • Whether uploads happened before or after the 23 September to 23 October 2025 sample window.
  • Which AI websites other than ChatGPT received files, and which account types staff used.
  • Whether OpenAI deleted the files, and whether any data was retained or used for training.
  • Whether the Dutch Data Protection Authority has taken a decision on the notification.

What the evidence supports

AI involvement: reported. The municipality's council letter, as reported by two outlets, states that a sample of staff data traffic found files with residents' and employees' personal data, including youth-care documents, had been sent to public AI websites such as ChatGPT, and the municipality asked OpenAI to delete the uploaded files. The privacy harm is that transfer of residents' and employees' records into AI services without their knowledge. The sources report the uploads; they report no output about the people concerned, and whether the data was retained or used for training is not established (an expert's view on training is opinion).

4 claims: 4 reported. What the statuses mean

Reported According to the council letter as reported, a sample of staff data traffic from 23 September to 23 October 2025 found that files containing personal data of residents and employees had been uploaded to public AI websites such as ChatGPT, including youth-care documents, internal reports and CVs, mostly from care and support departments.

Causal attribution. The municipality's own account in its council letter, relayed by two outlets that share that origin.

  • omroepbrabant.nl(opens in new tab) supports · Dutch
    'Uit die steekproef is aan het licht gekomen dat er bestanden met persoonlijke gegevens naar openbare AI-websites zoals ChatGPT zijn gestuurd.'; 'Denk aan Jeugdwetdocumenten, interne verslagen en cv'; 'De steekproef ging over de periode van 23 september tot 23 oktober'
  • binnenlandsbestuur.nl(opens in new tab) supports · Dutch
    'In een steekproef over de periode van 23 september tot 23 oktober 2025 constateerde de gemeente dat verschillende soorten bestanden met persoonsgegevens waren geüpload naar openbare AI-websites.'
Reported According to Omroep Brabant's account of the advisory firm's findings, the youth-care documents contained information about the mental and physical health of minor children, and social-support (WMO) documents, applicants' CVs and employees' reflection reports were also entered into the AI tool.

Causal attribution. The advisory firm's findings as reported by one outlet; the report itself was not read.

  • omroepbrabant.nl(opens in new tab) supports · Dutch
    'documenten uit de Jeugdwet met daarin informatie over de mentale en fysieke gezondheid van minderjarige kinderen'; 'Maar ook documenten van de Wet Maatschappelijke Ondersteuning (WMO) zijn ingevoerd.'; 'van sollicitanten en reflectieverslagen van medewerkers met daarin informatie over werkprestaties zijn in de Ai-tool terechtgekomen.'
Reported The municipality reported the breach to the Dutch Data Protection Authority on 23 October, stopped staff using public AI websites (allowing only Copilot in its secured environment), and asked OpenAI to delete the uploaded files.

Causal attribution. The municipality's statements of its response, relayed by two outlets sharing the council-letter origin.

  • omroepbrabant.nl(opens in new tab) supports · Dutch
    'Het datalek is op 23 oktober gemeld bij de Autoriteit Persoonsgegevens.'; 'De gemeente heeft OpenAI (het bedrijf achter ChatGPT) verzocht om de bestanden die vanuit Eindhoven zijn geüpload te verwijderen.'
  • binnenlandsbestuur.nl(opens in new tab) supports · Dutch
    'Sinds 23 oktober kunnen medewerkers alleen nog gebruikmaken van Copilot binnen de beveiligde gemeente-omgeving.'
Reported The council says the scale of the uploads cannot be established because the data was kept for only 30 days, that it therefore cannot inform those affected, and that individual uploaded data cannot easily be extracted by third parties though the risk cannot be fully excluded; a spokesperson said OpenAI had not yet replied.

Causal attribution. The council's and a spokesperson's statements about scope and risk.

  • omroepbrabant.nl(opens in new tab) supports · Dutch
    'Daarom is het volgens het college ook niet mogelijk om mensen van wie gegevens gelekt zijn te informeren.'; 'Individuele gegevens die zijn geüpload in een AI-tool kunnen niet eenvoudig door derden uit de tool worden gehaald en worden misbruikt.'
  • omroepbrabant.nl(opens in new tab) supports · Dutch
    'De gemeente Eindhoven heeft van OpenAi nog geen reactie gehad op hun verzoek, zo liet een woordvoerder vrijdag weten.'
  • binnenlandsbestuur.nl(opens in new tab) supports · Dutch
    'De totale omvang van de gedeelde gegevens is niet vast te stellen, omdat deze gegevens maximaal 30 dagen beschikbaar zijn.'

Sources

3 sources inspected, from 2 underlying accounts. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

Read in Dutch on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Omroep Brabant's report of the council information letter. Applies to s1.

Read in Dutch on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Omroep Brabant's follow-up citing the advisory firm's findings and a municipal spokesperson; the firm's report itself was not read. Applies to s2.

Read in Dutch on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Binnenlands Bestuur's report of the same council letter, so it shares the first source's group. Applies to s3.

Event countries: Netherlands. Affected-person countries: Netherlands. Court countries: Unknown.

The uploads were found in the data traffic of the municipality of Eindhoven's staff, and the files concern residents and employees of that Dutch municipality. No court is involved.

Reviewed for publication 2026-10-12: Published under the 2026-10-06 private-information ruling: the municipality's council letter, as reported by two outlets, describes staff actually uploading files with residents' youth-care and social-support data and applicants' CVs to public AI websites such as ChatGPT, without the knowledge of the people concerned. The scale is unknown and is recorded as such; the council's view that misuse risk is limited is recorded with it.

People described

Residents of Eindhoven whose youth-care (Jeugdwet) and social-support (WMO) files were uploaded, including children, plus job applicants and municipal employees whose CVs and reflection reports were uploaded

People reported harmed in this case

Not reliably quantifiable from the sources

The council says the scale cannot be established because the uploaded data was kept for only 30 days, and that it therefore cannot inform the people concerned. No count of residents, children, applicants or employees is given, so numeric zero placeholders are recorded. The staff who uploaded the files are not counted.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Tags

#privacy#government#municipality#youth-care#health-data#chatgpt#unauthorised-ai-use#netherlands

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). Eindhoven municipality says staff uploaded files with residents' youth-care and social-support data and applicants' CVs to public AI websites such as ChatGPT. AI incidents. https://nope.net/incidents/2025-eindhoven-municipal-staff-uploaded-residents-youth-care-and-social-support-files-to-public-ai-websites

BibTeX

@misc{2025_eindhoven_municipal_staff_uploaded_residents_youth_care_and_social_support_files_to_public_ai_websites,
  title = {Eindhoven municipality says staff uploaded files with residents' youth-care and social-support data and applicants' CVs to public AI websites such as ChatGPT},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2025-eindhoven-municipal-staff-uploaded-residents-youth-care-and-social-support-files-to-public-ai-websites}
}

Related cases

Medium ChatGPT

Texas health plan says an employee uploaded a file of members' personal and prescription data to ChatGPT from a home network, against its policy

Community First Health Plans, a nonprofit health plan in San Antonio, Texas, said in a 29 June 2026 release that on the evening of 29 April 2026 one of its employees uploaded a file containing personal information of some members to ChatGPT from a home computer network, circumventing the plan's firewall safeguards and violating its policy. The plan says it does not use ChatGPT and that its systems detected the violation and alerted its IT department. According to the release, the file may have included members' names, addresses, dates of birth, member identification numbers and prescription drug information. The next morning the plan revoked the employee's access, directed and verified deletion of the data from the employee's ChatGPT account, asked OpenAI to delete any related data, and ended its relationship with the employee. It notified affected members and federal and state agencies, offered 12 months of identity monitoring and says it is not aware of any misuse. The release gives no number of affected members.

Low ChatGPT

NSW Reconstruction Authority says a former temporary staff member uploaded 2031 Resilient Homes participants' personal data to ChatGPT without authorisation

The NSW Reconstruction Authority says that between 12 and 15 March 2025 a former temporary staff member (called a former contractor in its first notice) uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information, 10 columns and more than 12,000 rows, to ChatGPT, an AI platform the Authority had not authorised. The Authority disclosed the breach on 6 October 2025, estimating that up to 3000 people were affected, and later said external forensic analysis confirmed that 2031 people had some of their data uploaded, including names, contact details, addresses, dates of birth, sensitive personal and health information and limited financial commentary. It says no driver licence, Medicare, passport or Tax File Numbers were disclosed and that there is no evidence the data is publicly available or was accessed by a third party; whether OpenAI retained or used the data is not addressed. The Authority apologised, contacted affected people with ID Support NSW, offered to compensate the replacement of compromised identity documents and notified the NSW Privacy Commissioner. A program participant told the ABC the information was deeply personal and that they felt concerned. No misuse of the data is reported.

Medium Unidentified OpenAI generative AI service (reported)

Health-guidance contractor says an employee entered insured members' names and disease information into an unauthorised external generative AI service

A local-government employees' mutual aid association said in a notice dated 4 September 2026 that RIZAP, the company it contracts for specific health guidance, had reported that on 20 August 2026 it emerged that a RIZAP staff member, during data-extraction work, had entered data containing personal information into an external generative AI service that RIZAP did not permit. The association says 726 of its members across 14 branches are covered and lists the data as membership numbers, email addresses, names, dates of birth, sex, some addresses and phone numbers, the type of health guidance and, for members with them, high blood pressure, diabetes or dyslipidaemia. The IHI group health insurance society reported 210 of its members in a 2 September notice that, according to a security news site, names OpenAI as the provider, says the matter came to light through the employee's own report, and says OpenAI answered on 1 September that the data had not been used for model training. RIZAP's own release, as described in an ITmedia column, says the information was uploaded by mistake to a generative AI service the employee used privately, and that the company confirmed no possibility of viewing by third parties other than the service operator or of use in training. Whether the provider's staff could view the data was still being checked when the insurers published.

Low ChatGPT

Adult ChatGPT Plus subscriber says the account was classified as a teen and restricted, and that OpenAI said profiling had to come first; first-person post

In a Reddit post of 11 October 2026, a ChatGPT Plus subscriber who says they are an adult (36, by the post's own account) writes that when OpenAI's age checks rolled out their account was classified as a teen account and put on a restricted account. The poster says they had earlier emailed OpenAI asking for verification options without ID or a photo, received a canned reply about the verification provider Persona, and on escalating to data protection was told they had to be profiled first. The poster says they then cancelled the subscription. OpenAI's Help Center says ChatGPT uses an age prediction system that reads account signals, automatically enables the teen experience when it predicts an account may belong to someone under 18, can get this wrong, and lets adults verify their age to remove it. The account is the poster's own and is not corroborated.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents