{"meta":{"exportedAt":"2026-10-31T07:55:32.636Z","formatVersion":2,"selection":{"q":"employee-data-upload","system":"","harm":"","context":"","country":"","role":"","relation":"contextual","evidence":"","year":"","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":1,"coverage":{"cases":1,"countries":1,"languages":1,"unknownLocation":0,"locationPending":0,"unknownLanguage":0,"unknownDate":1,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":0,"contextualRelations":1,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2026-estonia-data-protection-inspectorate-says-bank-employee-uploaded-employment-contracts-to-shared-ai-service-account-colleagues-could-view","caseFacts":{"claims":[{"id":"c1","status":"documented","evidence":[{"locator":"Panga töötaja laadis levinud tehisaru veebiteenusesse töölepingud, mis said seeläbi kättesaadavaks sama tehisaru kontot kasutavatele teistele töötajatele.","relation":"supports","source_id":"s1"}],"assertion":"AKI's overview of third-quarter 2026 breach notifications lists a case in which a bank employee uploaded employment contracts to a widely used AI web service, making them available to other employees using the same AI account.","causal_attribution":"The regulator's published overview establishes that it recorded this description; the underlying facts come from the breach notification."},{"id":"c2","status":"reported","evidence":[{"locator":"Saame öelda, et tehisarusüsteemi sisestati mõne üksiku töötaja töölepingud ning need muutusid sama kontot kasutanud teistele töötajatele kättesaadavaks","relation":"supports","source_id":"s2"}],"assertion":"AKI told Geenius that the employment contracts of a few individual employees had been entered into the AI system and became accessible to other employees using the same account.","causal_attribution":"AKI's statement to the outlet."},{"id":"c3","status":"reported","evidence":[{"locator":"Sama kontot kasutanud kolleegid said neid vaadata ja alla laadida.","relation":"supports","source_id":"s2"}],"assertion":"Geenius reports that colleagues who used the same account could view and download the contracts.","causal_attribution":"The outlet's summary; AKI's quoted statement says 'accessible'."},{"id":"c4","status":"reported","evidence":[{"locator":"Pank teavitas juhtumist puudutatud inimesi ning sulges oma töötajatele selle tehisarusüsteemi kasutamise võimaluse.","relation":"supports","source_id":"s2"}],"assertion":"The bank informed the people affected and blocked its employees from using that AI system.","causal_attribution":"Reported by Geenius from AKI's information."},{"id":"c5","status":"reported","evidence":[{"locator":"Andmekaitse inspektsioon (AKI) panga nime ei avaldanud.","relation":"supports","source_id":"s2"},{"locator":"Täpsemaid asjaolusid inspektsioon ei avaldanud.","relation":"supports","source_id":"s2"}],"assertion":"AKI did not name the bank or disclose further circumstances.","causal_attribution":"The limits of the public record."}],"effects":[{"label":"bank employees' employment contracts were uploaded to an AI service and became accessible to colleagues sharing the account","claim_id":"c2","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.aki.ee/uudised/kolmandas-kvartalis-esitati-rekordarv-rikkumisteateid","kind":"regulator_statement","access":"read","language":"et","translation_note":"Read in Estonian on 2026-10-31; translation by the research agent, an AI. AKI news item of 8 October 2026 summarising third-quarter 2026 breach notifications, with a one-sentence description of the case.","independence_group":"aki-estonia"},{"id":"s2","url":"https://forte.delfi.ee/artikkel/120621443/geenius-eesti-pangatootaja-laadis-toolepingud-tehisarusse-jarjest-rohkem-tundlikke-andmeid-satub-ai-katte","kind":"news_report","access":"read","language":"et","translation_note":"Read in Estonian on 2026-10-31; translation by the research agent, an AI. Delfi Forte excerpt, dated 30 October 2026, of a Geenius article quoting AKI's answer to the outlet's inquiry; the excerpt ends 'Loe edasi Digigeeniuse portaalist' and the full Digigeenius article was not read; the case facts come from AKI, so it shares s1's group.","independence_group":"aki-estonia"}],"version":1,"ai_roles":["others_use"],"contexts":["work","privacy"],"unknowns":["Which bank and which AI service were involved.","When the upload happened (it was notified to AKI in the third quarter of 2026).","How many employees' contracts were exposed and how many colleagues accessed them.","Whether the AI provider retained or used the uploaded contracts."],"geography":{"basis":"Geenius describes the employer as an Estonian bank ('Ühe Eesti panga töötaja'), and the case was notified to Estonia's data protection inspectorate; the event is recorded in Estonia on that basis. The affected employees' countries of residence are not stated.","court_countries":[],"event_countries":["EE"],"affected_person_countries":[]},"publication":{"basis":"Published under the 2026-10-06 privacy-capture boundary: the national data protection regulator records that employees' employment contracts were uploaded into an AI web service and became accessible to colleagues through its shared account, and the bank notified those affected. The exposure ran through the AI service's shared account to co-workers, as well as to the service itself.","reviewed_on":"2026-10-31"},"ai_involvement":{"basis":"Estonia's data protection inspectorate, which received the breach notification, states that a bank employee uploaded employment contracts to a widely used AI web service and that, through the AI account shared with other employees, the contracts became accessible to them. The capture of the contracts into the AI service and their exposure through its shared account are the reported privacy harm; the bank notified the affected employees. The AI service is not named, and whether the provider retained or used the files is not reported.","status":"supported"},"person_relations":["received_personal_information"]},"name":"Estonia's data protection inspectorate says a bank employee uploaded staff employment contracts to an AI service whose shared account let colleagues view them","summary":"In its overview of personal-data breach notifications for the third quarter of 2026, published on 8 October 2026, Estonia's Data Protection Inspectorate (AKI) listed a case in which a bank employee uploaded employment contracts to a widely used AI web service, making them available to other employees who used the same AI account. Answering questions from the technology outlet Geenius, AKI said the employment contracts of a few individual employees had been entered into the AI system and became accessible to other employees using the same account; Geenius reports that those colleagues could view and download them. According to the report, the bank informed the people affected and blocked its employees from using that AI system. AKI did not name the bank, the AI service or further circumstances.","incidentKind":"single_event","incidentDatePrecision":"unknown","exposurePattern":"unknown","reportedDate":"2026-10-08","aiSystem":"A widely used AI web service, not named, into which a bank employee uploaded employment contracts under an account shared with other employees","aiProduct":"Unidentified AI web service","severity":"low","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"According to Estonia's data protection inspectorate, the employment contracts of a few bank employees were uploaded to an AI service and became accessible to other employees using the same account; the bank notified the people affected.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":0,"affectedCountStatus":"unquantified","affectedCountEvidence":"AKI says the contracts of 'a few individual employees' were exposed; no number is given, so the count is unquantified with zero placeholders. The employee who uploaded the files and the colleagues who could view them are not counted as harmed.","victimAgeRange":"adult","jurisdiction":"EE","platformType":"other","outcomeType":"internal_action","outcomeStatus":"unknown","primarySourceUrl":"https://www.aki.ee/uudised/kolmandas-kvartalis-esitati-rekordarv-rikkumisteateid","primarySourceLabel":"Andmekaitse Inspektsioon, Kolmandas kvartalis esitati rekordarv rikkumisteateid, 8 October 2026","firstPublishedAt":"2026-10-31T03:10:15.415884+00:00","updatedAt":"2026-10-31T03:10:15.415884+00:00","scopeVersion":"facts-v3","tags":["employee-data-upload","shared-ai-account","employment-contracts","data-breach-notification","banking"]}]}