{"meta":{"exportedAt":"2026-10-23T09:15:02.936Z","formatVersion":2,"selection":{"q":"gdpr","system":"","harm":"","context":"","country":"","role":"","relation":"unknown","evidence":"","year":"","response":"regulatory","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":2,"coverage":{"cases":2,"countries":1,"languages":2,"unknownLocation":1,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":2,"minors":1,"coreRelations":0,"contextualRelations":0,"mixedRelations":0,"unknownRelations":2,"relationPending":2,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2025-holmen-norway-gdpr","metadataReview":{"version":1,"geography":{"basis":"Carried forward from the 2026-09-15 metadata review and now checked against the inspected noyb press page. noyb describes him as the Norwegian user and refers to his home town without naming it; residence in Trondheim rests on the retained row, so affected-person country is NO by reported residence. The noyb page does not state where he queried ChatGPT or where the output was viewed, so the event location remains unknown after review. The complaint was filed with the Norwegian data protection authority (Datatilsynet), a regulator rather than a court, so court_countries is empty as a reviewed result. This is a metadata review and does not verify the underlying account.","evidence":[{"kind":"existing_record","locator":"Trondheim, Norway","location":"victim_description","supports":["affected_person_countries"],"countries":["NO"]},{"kind":"source_body","locator":"'When the Norwegian user Arve Hjalmar Holmen wanted to find out if ChatGPT had any information about him, he was confronted with a made up horror story'","location":"https://noyb.eu/en/ai-hallucinations-chatgpt-created-fake-child-murderer","supports":["affected_person_countries"],"countries":["NO"]}],"court_countries":[],"event_countries":[],"affected_person_countries":["NO"]},"unresolved":["The location where the ChatGPT output was generated or viewed is not stated in the inspected noyb page or the retained row; event_countries remains empty as a reviewed unknown.","No court proceeding: the Datatilsynet complaint is a regulatory complaint, so court_countries is empty as a reviewed result.","The complaint PDF linked from the noyb page and any Norwegian-language coverage were not inspected; only the English press page was reviewed."],"reviewed_on":"2026-09-23","source_reviews":[{"url":"https://noyb.eu/en/ai-hallucinations-chatgpt-created-fake-child-murderer","notes":"Read live on 2026-09-23 (noyb, 20 March 2025; html lang=en; the page offers translations in other languages). Describes the complainant as a Norwegian user, the fabricated output (murder of two of his children, attempted murder of his third son, 21-year sentence), the mix of real details including his home town, and the complaint filed with the Norwegian Datatilsynet. Does not locate the query or the viewing of the output.","access":"read","language":"en"}]},"name":"Holmen v. OpenAI - Norway GDPR Complaint","summary":"ChatGPT falsely accused Norwegian citizen Arve Hjalmar Holmen of murdering two of his sons, attempting to murder his third son, and being sentenced to 21 years prison. Mixed real personal details with horrific fabrications. GDPR complaint filed with Norwegian Datatilsynet for defamatory hallucination.","incidentDate":"2025-03-01","incidentKind":"single_event","incidentDatePrecision":"month","exposurePattern":"single_interaction","reportedDate":"2025-03-15","aiSystem":"ChatGPT","aiProduct":"ChatGPT","aiCompany":"OpenAI","severity":"medium","verificationStatus":"verified","harmCategories":["psychological_manipulation","identity_destabilization","third_party_harm_facilitation"],"harmOutcomes":["psychological_distress","reputational_harm"],"harmOutcomeSummary":"Arve Hjalmar Holmen discovered ChatGPT combining real personal details with false claims that he murdered two sons and attempted to murder a third. He filed a GDPR complaint over the defamatory output.","frameworkFacets":["P3a","P5b","P5c"],"pathwayDirection":"inward","causationStatus":"alleged","participantUsersAffectedMin":1,"otherPeopleHarmedMin":0,"affectedCountStatus":"exact","affectedCountEvidence":"The regulator complaint documents one named participant's distress and reputational harm.","victimAgeRange":"adult","jurisdiction":"NO","platformType":"assistant","outcomeType":"regulatory_action","outcomeStatus":"ongoing","primarySourceUrl":"https://noyb.eu/en/ai-hallucinations-chatgpt-created-fake-child-murderer","primarySourceLabel":"noyb — 'AI hallucinations: ChatGPT created a fake child murderer', the complaint filed with Datatilsynet","firstPublishedAt":"2026-01-13T10:13:04.624733+00:00","updatedAt":"2026-09-30T01:17:05.427919+00:00","scopeVersion":"participant-v2","tags":["norway","gdpr","chatgpt","defamation","hallucination","noyb","false_accusations"]},{"id":"2023-replika-italy-gdpr","metadataReview":{"version":1,"geography":{"basis":"Geographic fields reviewed using the cited source-body passages and, where identified, retained dossier passages. Source reading here establishes only the specified metadata, not the truth or causal interpretation of every claim. Affected-person countries refer to reported location or residence, not citizenship or a complete residence history.","evidence":[{"kind":"source_body","locator":"Italian paragraphs beginning “Il Garante della privacy ferma” and “Replika viola”: processing of Italian users’ personal data.","location":"https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9852506","supports":["event_countries","affected_person_countries"],"countries":["IT"]}],"court_countries":[],"event_countries":["IT"],"affected_person_countries":["IT"]},"unresolved":["No court country established in this review. Regulatory authorities and police locations are not automatically courts."],"reviewed_on":"2026-09-15","source_reviews":[{"url":"https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9852506","notes":"Italian body and embedded official English translation read. Country relates to affected users/data rights. The Garante is a regulator, not a court.","access":"read","language":"it"}]},"name":"Replika Italy GDPR Ban and Fine","summary":"Italy's data protection authority (Garante) blocked Replika from processing Italian user data in February 2023 after finding the chatbot engaged in sexually suggestive conversations with minors. In May 2025, Replika was fined €5 million for GDPR violations.","incidentDate":"2023-02-02","incidentKind":"bounded_series","incidentDatePrecision":"day","exposurePattern":"repeated_interactions","reportedDate":"2023-02-02","aiSystem":"Replika","aiProduct":"Replika","aiCompany":"Luka, Inc.","severity":"high","verificationStatus":"verified","harmCategories":["minor_exploitation","romantic_escalation"],"harmOutcomes":["exploitation_or_abuse","psychological_distress"],"harmOutcomeSummary":"Italy's data-protection authority found that Replika engaged minors in sexually suggestive participant-facing conversations without effective age assurance and blocked the service from processing Italian user data.","frameworkFacets":["P1d","P2b","P2c","P5a","P5d"],"pathwayDirection":"inward","causationStatus":"established","participantUsersAffectedMin":0,"otherPeopleHarmedMin":0,"affectedCountStatus":"unquantified","affectedCountEvidence":"The regulator documents harmful sexualized interactions with minors but does not publish a reliable distinct-person count.","victimAgeRange":"minor","jurisdiction":"IT","platformType":"companion","outcomeType":"regulatory_action","outcomeStatus":"resolved","primarySourceUrl":"https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9852506","primarySourceLabel":"Garante per la protezione dei dati personali (Italian DPA)","firstPublishedAt":"2026-01-11T11:26:29.042792+00:00","updatedAt":"2026-09-30T01:16:49.77617+00:00","scopeVersion":"participant-v2","tags":["regulatory","gdpr","italy","replika","fine","minor_exploitation","eu"]}]}