{"meta":{"exportedAt":"2026-10-12T09:37:06.940Z","formatVersion":2,"selection":{"q":"municipality","system":"","harm":"","context":"","country":"","role":"","relation":"contextual","evidence":"","year":"","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":1,"coverage":{"cases":1,"countries":1,"languages":1,"unknownLocation":0,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":0,"contextualRelations":1,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2025-eindhoven-municipal-staff-uploaded-residents-youth-care-and-social-support-files-to-public-ai-websites","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'Uit die steekproef is aan het licht gekomen dat er bestanden met persoonlijke gegevens naar openbare AI-websites zoals ChatGPT zijn gestuurd.'; 'Denk aan Jeugdwetdocumenten, interne verslagen en cv'; 'De steekproef ging over de periode van 23 september tot 23 oktober'","relation":"supports","source_id":"s1"},{"locator":"'In een steekproef over de periode van 23 september tot 23 oktober 2025 constateerde de gemeente dat verschillende soorten bestanden met persoonsgegevens waren geüpload naar openbare AI-websites.'","relation":"supports","source_id":"s3"}],"assertion":"According to the council letter as reported, a sample of staff data traffic from 23 September to 23 October 2025 found that files containing personal data of residents and employees had been uploaded to public AI websites such as ChatGPT, including youth-care documents, internal reports and CVs, mostly from care and support departments.","causal_attribution":"The municipality's own account in its council letter, relayed by two outlets that share that origin."},{"id":"c2","status":"reported","evidence":[{"locator":"'documenten uit de Jeugdwet met daarin informatie over de mentale en fysieke gezondheid van minderjarige kinderen'; 'Maar ook documenten van de Wet Maatschappelijke Ondersteuning (WMO) zijn ingevoerd.'; 'van sollicitanten en reflectieverslagen van medewerkers met daarin informatie over werkprestaties zijn in de Ai-tool terechtgekomen.'","relation":"supports","source_id":"s2"}],"assertion":"According to Omroep Brabant's account of the advisory firm's findings, the youth-care documents contained information about the mental and physical health of minor children, and social-support (WMO) documents, applicants' CVs and employees' reflection reports were also entered into the AI tool.","causal_attribution":"The advisory firm's findings as reported by one outlet; the report itself was not read."},{"id":"c3","status":"reported","evidence":[{"locator":"'Het datalek is op 23 oktober gemeld bij de Autoriteit Persoonsgegevens.'; 'De gemeente heeft OpenAI (het bedrijf achter ChatGPT) verzocht om de bestanden die vanuit Eindhoven zijn geüpload te verwijderen.'","relation":"supports","source_id":"s1"},{"locator":"'Sinds 23 oktober kunnen medewerkers alleen nog gebruikmaken van Copilot binnen de beveiligde gemeente-omgeving.'","relation":"supports","source_id":"s3"}],"assertion":"The municipality reported the breach to the Dutch Data Protection Authority on 23 October, stopped staff using public AI websites (allowing only Copilot in its secured environment), and asked OpenAI to delete the uploaded files.","causal_attribution":"The municipality's statements of its response, relayed by two outlets sharing the council-letter origin."},{"id":"c4","status":"reported","evidence":[{"locator":"'Daarom is het volgens het college ook niet mogelijk om mensen van wie gegevens gelekt zijn te informeren.'; 'Individuele gegevens die zijn geüpload in een AI-tool kunnen niet eenvoudig door derden uit de tool worden gehaald en worden misbruikt.'","relation":"supports","source_id":"s1"},{"locator":"'De gemeente Eindhoven heeft van OpenAi nog geen reactie gehad op hun verzoek, zo liet een woordvoerder vrijdag weten.'","relation":"supports","source_id":"s2"},{"locator":"'De totale omvang van de gedeelde gegevens is niet vast te stellen, omdat deze gegevens maximaal 30 dagen beschikbaar zijn.'","relation":"supports","source_id":"s3"}],"assertion":"The council says the scale of the uploads cannot be established because the data was kept for only 30 days, that it therefore cannot inform those affected, and that individual uploaded data cannot easily be extracted by third parties though the risk cannot be fully excluded; a spokesperson said OpenAI had not yet replied.","causal_attribution":"The council's and a spokesperson's statements about scope and risk."}],"effects":[{"label":"residents' youth-care and social-support files and job applicants' CVs uploaded to public AI websites without their knowledge (council letter, as reported)","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.omroepbrabant.nl/nieuws/6001041/datalek-gemeente-eindhoven-deelt-persoonsgegevens-met-openbare-ai-websites","kind":"news_report","access":"read","language":"nl","translation_note":"Read in Dutch on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Omroep Brabant's report of the council information letter.","independence_group":"eindhoven-council-letter"},{"id":"s2","url":"https://www.omroepbrabant.nl/nieuws/6001062/datalek-eindhoven-met-kwetsbare-burgers-verwijderverzoek-is-kansloos","kind":"news_report","access":"read","language":"nl","translation_note":"Read in Dutch on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Omroep Brabant's follow-up citing the advisory firm's findings and a municipal spokesperson; the firm's report itself was not read.","independence_group":"omroep-brabant-hooghiemstra-findings"},{"id":"s3","url":"https://www.binnenlandsbestuur.nl/digitaal/gemeente-eindhoven-blokkeert-chatgpt-na-datalek","kind":"news_report","access":"read","language":"nl","translation_note":"Read in Dutch on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Binnenlands Bestuur's report of the same council letter, so it shares the first source's group.","independence_group":"eindhoven-council-letter"}],"version":1,"ai_roles":["others_use"],"contexts":["public_services","health","work","privacy"],"unknowns":["How many residents, children, applicants and employees had data uploaded.","Whether uploads happened before or after the 23 September to 23 October 2025 sample window.","Which AI websites other than ChatGPT received files, and which account types staff used.","Whether OpenAI deleted the files, and whether any data was retained or used for training.","Whether the Dutch Data Protection Authority has taken a decision on the notification."],"geography":{"basis":"The uploads were found in the data traffic of the municipality of Eindhoven's staff, and the files concern residents and employees of that Dutch municipality. No court is involved.","court_countries":[],"event_countries":["NL"],"affected_person_countries":["NL"]},"publication":{"basis":"Published under the 2026-10-06 private-information ruling: the municipality's council letter, as reported by two outlets, describes staff actually uploading files with residents' youth-care and social-support data and applicants' CVs to public AI websites such as ChatGPT, without the knowledge of the people concerned. The scale is unknown and is recorded as such; the council's view that misuse risk is limited is recorded with it.","reviewed_on":"2026-10-12"},"ai_involvement":{"basis":"The municipality's council letter, as reported by two outlets, states that a sample of staff data traffic found files with residents' and employees' personal data, including youth-care documents, had been sent to public AI websites such as ChatGPT, and the municipality asked OpenAI to delete the uploaded files. The privacy harm is that transfer of residents' and employees' records into AI services without their knowledge. The sources report the uploads; they report no output about the people concerned, and whether the data was retained or used for training is not established (an expert's view on training is opinion).","status":"reported"},"person_relations":["received_personal_information"]},"name":"Eindhoven municipality says staff uploaded files with residents' youth-care and social-support data and applicants' CVs to public AI websites such as ChatGPT","summary":"The municipality of Eindhoven in the Netherlands told its council in an information letter shared on Thursday 18 December 2025 that a sample of staff data traffic from 23 September to 23 October 2025 showed files containing personal data of residents and employees had been sent to public AI websites such as ChatGPT, according to Omroep Brabant and Binnenlands Bestuur. The files included youth-care (Jeugdwet) documents, internal reports and CVs, mostly from departments that provide care and support to residents. According to Omroep Brabant's account of findings by the advisory firm Hooghiemstra & Partners, the youth-care documents held information about the mental and physical health of minor children, and social-support (WMO) documents and applicants' CVs were also entered. The municipality reported the breach to the Dutch Data Protection Authority on 23 October, blocked public AI websites and asked OpenAI to delete the files. The council says the scale cannot be determined because the data was kept for only 30 days, so it cannot inform those affected, and that the risk of misuse is limited but cannot be ruled out. A spokesperson said OpenAI had not yet replied.","incidentDate":"2025-09-23","incidentEndDate":"2025-10-23","incidentKind":"bounded_series","incidentDatePrecision":"day","exposurePattern":"repeated_interactions","reportedDate":"2025-12-18","aiSystem":"Public AI websites, which the municipality's council letter, as reported, names with ChatGPT as the example; the municipality asked OpenAI to delete the uploaded files","aiProduct":"ChatGPT (reported)","severity":"high","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"According to the municipality's council letter as reported, staff uploaded files containing personal data of residents and employees, including youth-care documents about children's mental and physical health and social-support files, to public AI websites such as ChatGPT; the council says it cannot determine the scale or inform those affected.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":0,"affectedCountStatus":"unquantified","affectedCountEvidence":"The council says the scale cannot be established because the uploaded data was kept for only 30 days, and that it therefore cannot inform the people concerned. No count of residents, children, applicants or employees is given, so numeric zero placeholders are recorded. The staff who uploaded the files are not counted.","victimAgeRange":"unknown","jurisdiction":"NL","platformType":"other","outcomeStatus":"ongoing","primarySourceUrl":"https://www.omroepbrabant.nl/nieuws/6001041/datalek-gemeente-eindhoven-deelt-persoonsgegevens-met-openbare-ai-websites","primarySourceLabel":"Omroep Brabant, 19 December 2025: Eindhoven data breach, municipality shares personal data with public AI websites","firstPublishedAt":"2026-10-12T03:35:14.550754+00:00","updatedAt":"2026-10-12T03:35:14.550754+00:00","scopeVersion":"facts-v3","tags":["privacy","government","municipality","youth-care","health-data","chatgpt","unauthorised-ai-use","netherlands"]}]}