{"meta":{"exportedAt":"2026-10-24T06:41:57.469Z","formatVersion":2,"selection":{"q":"employee-data","system":"","harm":"","context":"","country":"","role":"","relation":"contextual","evidence":"","year":"","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":1,"coverage":{"cases":1,"countries":0,"languages":2,"unknownLocation":1,"locationPending":0,"unknownLanguage":0,"unknownDate":1,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":0,"contextualRelations":1,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2026-japan-panasonic-group-company-says-project-member-uploaded-hr-data-on-about-334000-people-to-banned-generative-ai-service","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'社内プロジェクトに携わる社員が、パナソニックグループの従業員や元従業員、その家族ら計約33万4000人分の個人情報を含むデータを、社内で利用を禁止している外部の生成AIサービスにアップロードしていたと発表した。'; '今回の事案は外部からの不正な操作ではなく、当該社員の社内ルール違反によるものだと説明している。'","relation":"supports","source_id":"s1"},{"locator":"'プロジェクトのメンバーが社内ルールに違反し、2026年4月時点で人事情報システムに登録されていたデータの一部を、外部の生成AIサービスにアップロードした。'","relation":"supports","source_id":"s2"},{"locator":"'Een medewerker van Panasonic heeft persoonsgegevens van ongeveer 334.000 mensen geüpload naar een externe AI-dienst die binnen het bedrijf verboden is.'","relation":"supports","source_id":"s3"}],"assertion":"Panasonic Operational Excellence announced on 23 October 2026 that a staff member on an in-house project had uploaded data containing personal information on about 334,000 current and former Panasonic group employees and their family members to an external generative AI service whose use the company prohibits; the company says it was a breach of internal rules by the employee, not an outside attack.","causal_attribution":"All three articles relay the company's own announcement; the upload is the company's admission about its employee."},{"id":"c2","status":"reported","evidence":[{"locator":"'日本国内のパナソニックグループの従業員約7万5000人、元従業員約17万8000人と、その家族計約8万1000人。'; '一方、家族については、緊急連絡先として登録された氏名、住所、電話番号、メールアドレスが含まれる。'","relation":"supports","source_id":"s1"}],"assertion":"The uploaded data covered about 75,000 employees and about 178,000 former employees of Panasonic group companies in Japan (employee numbers, addresses, phone numbers and email addresses, without names) and about 81,000 family members registered as emergency contacts (names, addresses, phone numbers and email addresses).","causal_attribution":"The figures and data fields are the company's, as relayed by ITmedia; they are approximate."},{"id":"c3","status":"reported","evidence":[{"locator":"'当該社員は問題の発覚直後に、生成AIサービス上のチャット履歴と業務用PC内の対象データを削除した。'; '削除されたデータを30日間保持しており、今回のデータは10月25日まで保管される。'","relation":"supports","source_id":"s1"},{"locator":"'今回アップロードされたデータも、保持期間が終了する10月25日以降は、事業者側に残らないという。'","relation":"supports","source_id":"s2"}],"assertion":"The company says the employee deleted the chat history and the local data immediately after the problem came to light, that the provider confirmed training on the data was switched off, and that the provider keeps deleted data for 30 days, until 25 October.","causal_attribution":"The company relays the provider's account; neither article had the provider's own statement."},{"id":"c4","status":"reported","evidence":[{"locator":"'同社は9月29日に個人情報保護委員会へ報告している。'; '現時点で、対象の個人情報が一般に公開された事実や、不正利用による具体的な被害は確認されていない。'","relation":"supports","source_id":"s1"},{"locator":"'同社は9月29日、個人情報保護委員会に報告した。'; '今回の発表は、個人情報保護法に基づく本人通知の代替措置として行った。'","relation":"supports","source_id":"s2"}],"assertion":"The company reported the matter to the Personal Information Protection Commission on 29 September 2026 and says no public disclosure or concrete harm from misuse had been confirmed. CNET Japan reports that the company made its announcement in place of notifying each affected person individually under the personal-information protection law.","causal_attribution":"The report to the regulator is stated by the company; no Commission document was read."},{"id":"c5","status":"reported","evidence":[{"locator":"'Welke AI-dienst dat was, zegt Panasonic niet.'; 'Opvallend is dat Panasonic zijn medewerkers sinds 2023 een eigen AI-assistent geeft, PX-AI.'","relation":"supports","source_id":"s3"}],"assertion":"The company has not named the AI service; it has given staff an in-house AI assistant since 2023 and prohibits external services.","causal_attribution":"AI Insider's account of the announcement and of Panasonic's in-house assistant."}],"effects":[{"label":"HR data on current and former employees and their family emergency contacts uploaded to an external generative AI service without their knowledge (company announcement)","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.itmedia.co.jp/news/article/2610/23/2000002562/","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-24 (HTTP 200); quoted passages were translated into English by the research agent (an AI), not by a human translator. The article relays Panasonic Operational Excellence's announcement of 23 October 2026; the announcement page on holdings.panasonic returned HTTP 403 to the fetcher and had no Wayback capture, so it was not read directly.","independence_group":"panasonic-operational-excellence-statement"},{"id":"s2","url":"https://japan.cnet.com/article/35253904/","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-24 (HTTP 200); quoted passages were translated into English by the research agent (an AI), not by a human translator. The article (also carried in its JSON-LD body) relays Panasonic Operational Excellence's announcement of 23 October 2026; the announcement page on holdings.panasonic returned HTTP 403 to the fetcher and had no Wayback capture, so it was not read directly.","independence_group":"panasonic-operational-excellence-statement"},{"id":"s3","url":"https://aiinsider.nl/nieuws/datalek-bij-panasonic-medewerker-zette-gegevens-van-334-000-mensen-in-verboden-ai-dienst/","kind":"news_report","access":"read","language":"nl","translation_note":"Read in Dutch on 2026-10-24 (HTTP 200); quoted passages were translated into English by the research agent (an AI), not by a human translator. The article translates and relays the same Panasonic Operational Excellence announcement and cites Nikkei and Kansai TV, so it shares that origin.","independence_group":"panasonic-operational-excellence-statement"}],"version":1,"ai_roles":["institutional_use"],"contexts":["work","privacy"],"unknowns":["When the upload took place and when it was discovered; the articles give only the April 2026 data snapshot and the 29 September report to the Commission.","Which generative AI service and provider received the data.","Whether provider staff viewed the data during the 30-day retention period.","Whether any affected employee, former employee or family member was later notified individually; CNET Japan reports that the public announcement was made in place of individual notification.","Whether the Personal Information Protection Commission has taken any action, and whether the employee faced discipline."],"geography":{"basis":"ITmedia describes the affected people as employees and former employees of Panasonic group companies in Japan ('日本国内のパナソニックグループの従業員') and their family members. The articles do not say where the employee made the upload, so no event country is recorded. No court is involved.","court_countries":[],"event_countries":[],"affected_person_countries":["JP"]},"publication":{"basis":"Published under the 2026-10-06 private-information ruling: the company's announcement, relayed by ITmedia and CNET Japan, describes a project member actually uploading personnel data on current and former employees and their family emergency contacts to an external generative AI service, without the knowledge of the people concerned. The affected people are the uploading organisation's own workforce and their relatives, whose records were held for employment purposes. The account rests on the company's own admission; the provider's statements on training and retention are recorded as relayed.","reviewed_on":"2026-10-24"},"ai_involvement":{"basis":"The company's announcement, as reported by ITmedia and CNET Japan, states that a project member uploaded part of the personnel system's data, including addresses, phone numbers and email addresses of current and former employees and the names and contact details of family members, to an external generative AI service, which received and stored it; the provider keeps deleted data for 30 days. The privacy harm is that transfer of the people's data to the AI service without their knowledge. No generated output about them is reported, the service is not named, and the provider says training on the data was off.","status":"reported"},"person_relations":["received_personal_information"]},"name":"Panasonic group company says a project member uploaded HR data on about 334,000 employees, former staff and relatives to a banned generative AI service","summary":"Panasonic Operational Excellence, a Panasonic Holdings subsidiary, announced on 23 October 2026 that a member of an in-house project introducing a personnel information system had uploaded part of that system's data, as registered in April 2026, to an external generative AI service whose use the company prohibits. According to the announcement as reported by ITmedia and CNET Japan, the data covered about 75,000 current and about 178,000 former employees of Panasonic group companies in Japan (employee numbers, addresses, phone numbers and email addresses, without names) and about 81,000 family members registered as emergency contacts (names, addresses, phone numbers and email addresses), about 334,000 people in all. The company says the upload broke internal rules and was not an outside attack, that the employee deleted the chat history and the local data immediately after the problem came to light, and that it reported the matter to Japan's Personal Information Protection Commission on 29 September. The provider told the company that training on the data was switched off at upload but that deleted data is kept for 30 days, until 25 October. No public exposure or misuse had been confirmed. The company has not named the AI service.","incidentKind":"single_event","incidentDatePrecision":"unknown","exposurePattern":"single_interaction","reportedDate":"2026-10-23","aiSystem":"An external generative AI service that Panasonic group rules prohibit for work; the company's announcement, as relayed, does not name the service or its provider","aiProduct":"Unidentified chatbot","severity":"medium","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"According to the company's announcement as reported by ITmedia and CNET Japan, a project member uploaded HR data on about 334,000 current and former Panasonic group employees in Japan and their family emergency contacts, including addresses, phone numbers and email addresses, to an external generative AI service the company prohibits.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":0,"affectedCountStatus":"unquantified","affectedCountEvidence":"The company's figures, as relayed by ITmedia, are approximate: about 75,000 employees, about 178,000 former employees and about 81,000 family members, about 334,000 people in total ('計約33万4000人分'). Approximate figures are neither an exact count nor a documented minimum, so zero placeholders are used and the status is unquantified. The count would be of people whose personal information was transferred to the AI service, the privacy harm recorded here; no person is reported to have suffered misuse. The employee who uploaded the data is not counted.","victimAgeRange":"unknown","jurisdiction":"JP","platformType":"other","outcomeStatus":"ongoing","primarySourceUrl":"https://www.itmedia.co.jp/news/article/2610/23/2000002562/","primarySourceLabel":"ITmedia NEWS: Panasonic HD subsidiary uploaded personal data on about 334,000 people to a prohibited generative AI (23 Oct 2026)","firstPublishedAt":"2026-10-24T03:05:51.723571+00:00","updatedAt":"2026-10-24T03:05:51.723571+00:00","scopeVersion":"facts-v3","tags":["privacy","generative-ai","unauthorised-ai-use","employee-data","japan","data-protection-report"]}]}