{"meta":{"exportedAt":"2026-10-29T06:43:03.393Z","formatVersion":2,"selection":{"q":"passport","system":"","harm":"","context":"","country":"","role":"","relation":"contextual","evidence":"","year":"","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":3,"coverage":{"cases":3,"countries":2,"languages":1,"unknownLocation":0,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":1,"regulatory":1,"minors":0,"coreRelations":0,"contextualRelations":3,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2019-uk-passport-online-photo-checker-told-black-applicants-their-closed-mouths-looked-open","caseFacts":{"claims":[{"id":"c1","status":"corroborated","evidence":[{"locator":"The facial detection system informs people when it thinks the photo uploaded may not meet strict requirements, which include a plain expression and the mouth to be kept closed.","relation":"supports","source_id":"s1"},{"locator":"The passport application website uses an automated check to detect poor quality photos which do not meet Home Office rules. These include having a neutral expression, a closed mouth and looking straight at the camera.","relation":"supports","source_id":"s2"}],"assertion":"The UK government's online passport application runs an automated face-detection check that tells applicants when it thinks an uploaded photo does not meet the rules, which include a neutral expression and a closed mouth.","causal_attribution":"Function of the system as described independently by PA and the BBC."},{"id":"c2","status":"reported","evidence":[{"locator":"A young black man hoping to renew his passport online was stunned when the automated photo checker mistook his lips for an open mouth.; My mouth is closed, I just have big lips.","relation":"supports","source_id":"s1"}],"assertion":"A young Black man renewing his passport online says the automated checker mistook his lips for an open mouth, and that to submit the photo anyway he had to write in the comment box that his mouth was closed and he just had big lips.","causal_attribution":"The applicant's account to PA; the checker's message is attributed to him."},{"id":"c3","status":"reported","evidence":[{"locator":"She became frustrated after the system told her it looked like her eyes are closed and that it could not find the outline of her head.; proceeded with one of the images and received her passport without any further problems.","relation":"supports","source_id":"s1"},{"locator":"She told the BBC she had attempted to upload 10 different photographs over the course of a week, and each one had been rated as \"poor\" quality by the site.","relation":"supports","source_id":"s2"}],"assertion":"A Black educational technologist says the checker told her that her eyes looked closed and that it could not find the outline of her head, and that over a week she uploaded 10 photographs, each rated poor quality, before proceeding with one and receiving her passport.","causal_attribution":"Her own account, given to PA and to the BBC; two interviews with one witness are one origin."},{"id":"c4","status":"reported","evidence":[{"locator":"When posting about the issue on Twitter at the time, the Passport Office tweeted back to her, saying it was sorry the photo upload service hadn’t “worked as it should","relation":"supports","source_id":"s1"}],"assertion":"PA reported that when the technologist posted about the problem on Twitter, the Passport Office replied that it was sorry the photo upload service had not worked as it should.","causal_attribution":"PA's report of the Passport Office's reply; the tweet itself was not inspected."},{"id":"c5","status":"reported","evidence":[{"locator":"One black student said she was wrongly told her mouth looked open each time she uploaded five different photos to the government website.; which involved writing a note to say her mouth was indeed closed.; It should be the norm for these systems to work well for everyone, she added.","relation":"supports","source_id":"s2"}],"assertion":"A Black student says the checker wrongly told her that her mouth looked open on each of five photos she uploaded, and that she got one approved after challenging the verdict by writing a note to say her mouth was closed; she said such systems should work well for everyone.","causal_attribution":"The student's account to the BBC."},{"id":"c6","status":"reported","evidence":[{"locator":"Dark-skinned women are told their photos are poor quality 22% of the time, while the figure for light-skinned women is 14%; Photos of women with the darkest skin were four times more likely to be graded poor quality, than women with the lightest skin.","relation":"supports","source_id":"s2"}],"assertion":"The BBC fed 1,130 passport-style photos of politicians into the checker and reported that photos of dark-skinned women were graded poor quality 22% of the time against 14% for light-skinned women, and that photos of women with the darkest skin were four times more likely to be graded poor quality than those of women with the lightest skin.","causal_attribution":"The BBC's own test, which it says the Alan Turing Institute reproduced; reported as the BBC's finding."},{"id":"c7","status":"reported","evidence":[{"locator":"Documents released as part of a freedom of information request in 2019 had previously revealed the Home Office was aware of this problem, but decided \"overall performance\" was good enough to launch the online checker.; The automated checker was supplied to the government by an external provider which it declined to name.","relation":"supports","source_id":"s2"}],"assertion":"The BBC reported that documents released under a 2019 freedom of information request showed the Home Office was aware of the problem but decided overall performance was good enough to launch the checker, which an external provider it declined to name supplied.","causal_attribution":"The BBC's account of the FOI documents, which were not inspected."},{"id":"c8","status":"reported","evidence":[{"locator":"In the vast majority of cases where a photo does not pass our automated check, customers may override the outcome and submit the photo as part of their application.","relation":"supports","source_id":"s1"},{"locator":"Over nine million people have used this service and our systems are improving.","relation":"supports","source_id":"s2"}],"assertion":"The Home Office told PA in 2019 that in the vast majority of cases applicants whose photo fails the automated check may override it and submit the photo, and told the BBC in 2020 that over nine million people had used the service and its systems were improving.","causal_attribution":"The Home Office's statement, kept as its response."}],"effects":[{"label":"applicants say the checker wrongly said their mouths were open or eyes closed, forcing retries or written overrides","claim_id":"c2","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.irishnews.com/magazine/technology/2019/09/19/news/passport-photo-checker-falsely-flags-black-man-s-lips-as-open-mouth-1716760/","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-10-29; no translation.","independence_group":"pa-2019-09-19"},{"id":"s2","url":"https://www.bbc.co.uk/news/technology-54349538","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-10-29; no translation.","independence_group":"bbc-2020-10-08"}],"version":1,"ai_roles":["institutional_use"],"contexts":["public_services"],"unknowns":["The date of each applicant's attempts: the technologist posted in April 2019 according to PA, the man applied before 19 September 2019, and the student before 8 October 2020.","The supplier and design of the face-detection check; the Home Office declined to name the provider.","Whether the Home Office later changed or replaced the checker."],"geography":{"basis":"The check is part of the UK government's online passport application. PA and the BBC place the three applicants in England.","court_countries":[],"event_countries":["GB"],"affected_person_countries":["GB"]},"publication":{"basis":"Published as a government service's automated face-detection check making wrong statements about three described applicants' faces: they say it called closed mouths open and eyes closed and made them retry or override it. Their accounts are attributed; the BBC's group-level test and the Home Office's response are recorded separately.","reviewed_on":"2026-10-29"},"ai_involvement":{"basis":"PA and the BBC describe the passport website's photo check as an automated face-detection system that tells applicants when it thinks a photo breaks the rules. Three applicants say its verdicts about their own faces were wrong: it said a man's closed mouth was open, said a woman's eyes were closed and could not find the outline of her head, and said a student's mouth looked open on five photos. Those wrong verdicts are what made them retry or write overrides. The Home Office did not deny the failures; the BBC test and the 2019 FOI documents report a wider skin-tone pattern but do not establish the cause in each applicant's case.","status":"reported"},"person_relations":["made_claim_about"]},"name":"UK passport photo checker told Black applicants their closed mouths looked open, they say; a BBC test found darker-skinned women flagged more often","summary":"The UK government's online passport application uses an automated face-detection check that tells applicants when it thinks an uploaded photo breaks the rules, which include a neutral expression and a closed mouth. In September 2019 PA reported that a young Black man renewing his passport online said the checker mistook his lips for an open mouth, and that to submit the photo anyway he had to write in a comment box that his mouth was closed and he just had big lips. PA also reported that a Black educational technologist said the system told her that her eyes looked closed and that it could not find the outline of her head; she told the BBC she uploaded 10 photographs over a week and each was rated poor, and PA reported that the Passport Office tweeted that it was sorry the service had not worked as it should. In October 2020 a BBC investigation reported that a Black student said she was wrongly told her mouth looked open on each of five photos and got one accepted only by writing a note challenging the verdict. The BBC fed 1,130 passport-style photos of politicians into the checker and found that photos of dark-skinned women were graded poor quality 22% of the time against 14% for light-skinned women; it reported that documents released under a 2019 freedom of information request showed the Home Office knew of the problem but judged overall performance good enough to launch. The Home Office said applicants can override the check, that the checker is a customer aid, and that its systems are improving.","incidentDate":"2019-04-01","incidentKind":"bounded_series","incidentDatePrecision":"month","exposurePattern":"repeated_interactions","reportedDate":"2019-09-19","aiSystem":"Automated face-detection photo check on the UK government's online passport application, supplied to the Home Office by an external provider it declined to name","aiProduct":"HM Passport Office photo checker","severity":"low","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["psychological_distress"],"harmOutcomeSummary":"The applicants say the checker wrongly told them their mouths looked open or their eyes closed, so they had to retry with new photos or write explanations to override it. The man describes annoyance, the technologist frustration over a week of attempts, and the student says she should not have had to override a system that was not built for her. The technologist received her passport and the student got a photo approved; no refused passport is reported.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":3,"otherPeopleHarmedMin":0,"affectedCountStatus":"documented_minimum","affectedCountEvidence":"Three applicants each describe the checker misreading their own photos (PA: a man and a technologist; BBC: a student and the same technologist, counted once). PA says the man's case was not isolated, and the BBC test shows higher failure rates for darker-skinned people, but neither gives a count of other applicants harmed, so three is a minimum.","victimAgeRange":"adult","jurisdiction":"GB","platformType":"other","outcomeType":"media_coverage","outcomeStatus":"unknown","primarySourceUrl":"https://www.irishnews.com/magazine/technology/2019/09/19/news/passport-photo-checker-falsely-flags-black-man-s-lips-as-open-mouth-1716760/","primarySourceLabel":"PA via The Irish News, passport photo checker falsely flags black man's lips as open mouth, 19 September 2019","firstPublishedAt":"2026-10-29T03:13:05.403403+00:00","updatedAt":"2026-10-29T03:13:05.403403+00:00","scopeVersion":"facts-v3","tags":["passport","photo-checker","face-detection","home-office","public-services","gov-uk"]},{"id":"2024-london-bridge-met-police-live-facial-recognition-wrongly-matched-man-to-watchlisted-brother-stop-settlement","caseFacts":{"claims":[{"id":"c1","status":"documented","evidence":[{"locator":"'It is not in dispute that, on 23 February 2024, Mr Thompson passed an LFR deployment in the area around London Bridge. His face was matched to an image contained on the watchlist in use on that day, so as to generate an alert. The LFR system had detected a high level of facial similarity between images obtained of Mr Thompson and the image of his brother who was on the watchlist as being the subject of an outstanding arrest warrant'","relation":"supports","source_id":"s1"},{"locator":"'Mr Thompson was mistakenly identified during an LFR deployment near London Bridge after being matched to an image of his brother, who was on a police watchlist.'","relation":"supports","source_id":"s2"}],"assertion":"On 23 February 2024 the man passed a Met Police live facial recognition deployment near London Bridge; the system detected a high level of facial similarity between images of him and the watchlist image of his brother, who was the subject of an outstanding arrest warrant, and generated an alert.","causal_attribution":"Facts recorded by the court as not in dispute; the press summary is the court's own summary of the same judgment."},{"id":"c2","status":"reported","evidence":[{"locator":"'Mr Thompson was stopped, detained and questioned by police officers after having been matched by LFR'; 'they nevertheless scrutinised him, asked questions and made him prove his identity. When he declined to allow his fingerprints to be taken, he was threatened with arrest. Mr Thompson explains how the experience caused him to feel angry and distressed.'","relation":"supports","source_id":"s1"},{"locator":"'He was held by officers for almost 30 minutes, who repeatedly demanded scans of his fingerprints and threatened him with arrest'","relation":"supports","source_id":"s3"}],"assertion":"According to the court's account of his case, officers stopped, detained and questioned him, made him prove his identity, and threatened him with arrest when he declined to have his fingerprints taken; he says the experience left him angry and distressed.","causal_attribution":"The court's introduction summarises his account; Big Brother Watch relays the same account. Both rest on his evidence, so the claim is reported, and the 30-minute figure is attributed to Big Brother Watch."},{"id":"c3","status":"documented","evidence":[{"locator":"'They ceased their engagement with him after considering information held on the Police National Computer about his brother. Mr Thompson was able to show police a copy of his passport photograph on his phone, which enabled his identity to be confirmed.'","relation":"supports","source_id":"s1"}],"assertion":"Officers ended their engagement after considering police records about his brother, and he confirmed his identity with a copy of his passport photograph on his phone.","causal_attribution":"Facts set out in the judgment's account of the first claimant."},{"id":"c4","status":"documented","evidence":[{"locator":"'On 18 December 2024 a consent order was agreed (eventually sealed on 30 April 2025) by which grounds 1 and 2 of the original claim were withdrawn on terms as to costs and a settlement sum payable to Mr Thompson.'","relation":"supports","source_id":"s1"}],"assertion":"His original judicial review grounds about the stop were withdrawn under a consent order agreed on 18 December 2024 and sealed on 30 April 2025, on terms as to costs and a settlement sum payable to him.","causal_attribution":"Procedural history recorded in the judgment; the amount and any admission are not stated."},{"id":"c5","status":"documented","evidence":[{"locator":"'Accordingly, the claim is dismissed.'","relation":"supports","source_id":"s1"},{"locator":"'The court emphasised that it is not concerned with the merits of facial recognition technology as a policing tool.'","relation":"supports","source_id":"s2"}],"assertion":"On 21 April 2026 the Divisional Court dismissed the amended claim challenging the Met's revised September 2024 live facial recognition policy, saying it was not concerned with the merits of the technology as a policing tool.","causal_attribution":"Outcome of the judgment; the challenge concerned the revised policy, not the lawfulness of the February 2024 stop."},{"id":"c6","status":"reported","evidence":[{"locator":"'The claimants have announced plans to appeal.'; 'Thompson added: “No one should be treated like a criminal due to a computer error.”'","relation":"supports","source_id":"s4"}],"assertion":"IDTechWire reported on 22 April 2026 that the claimants planned to appeal, quoting him: 'No one should be treated like a criminal due to a computer error.'","causal_attribution":"Trade press report of the claimants' statements; no appeal decision was found."}],"effects":[{"label":"stopped, questioned and threatened with arrest after a live facial recognition false match, and left angry and distressed","claim_id":"c2","direction":"negative"}],"sources":[{"id":"s1","url":"https://caselaw.nationalarchives.gov.uk/ewhc/admin/2026/915","kind":"court_judgment","access":"read","language":"en","translation_note":"Read in English on 2026-10-26; no translation.","independence_group":"ewhc-2026-915"},{"id":"s2","url":"https://www.judiciary.uk/wp-content/uploads/2026/04/Summary-of-judgment-Thomson-and-Carlo-v-Metropolitan-Police-Commmissioner-AC-2024-LON-001764-21-04-2026.pdf","kind":"court_press_summary","access":"read","language":"en","translation_note":"Read in English on 2026-10-26; no translation.","independence_group":"ewhc-2026-915"},{"id":"s3","url":"https://bigbrotherwatch.org.uk/press-releases/met-police-face-major-legal-challenge-over-use-of-live-facial-recognition-technology/","kind":"advocacy_press_release","access":"read","language":"en","translation_note":"Read in English on 2026-10-26; no translation.","independence_group":"big-brother-watch"},{"id":"s4","url":"https://idtechwire.com/uk-high-court-upholds-met-police-lfr-policy-claimants-plan-appeal/","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-10-26; no translation.","independence_group":"idtechwire-2026-04-22"}],"version":1,"ai_roles":["institutional_use"],"contexts":["justice","privacy","public_services"],"unknowns":["How long the stop lasted according to the police; only Big Brother Watch gives almost 30 minutes.","The settlement amount and whether the force accepted any fault in the consent order.","Whether the claimants' announced appeal was filed or permitted.","Paragraph 20 of the judgment dates the use of LFR complained of to 23 February 2023; paragraphs 17 and 141 give 23 February 2024, which is used here."],"geography":{"basis":"The judgment places the deployment and stop near London Bridge station and says he was born and lives in London; the judicial review was decided by the High Court in London.","court_countries":["GB"],"event_countries":["GB"],"affected_person_countries":["GB"]},"publication":{"basis":"Published as a facial recognition false match leading to a police stop, with a legal outcome: the High Court judgment records the system's alert matching him to his brother's watchlist image as not in dispute, a consent order with a settlement sum paid to him, and the dismissal of his later challenge to the force's deployment policy.","reviewed_on":"2026-10-26"},"ai_involvement":{"basis":"The High Court records as not in dispute that the Met's live facial recognition system detected a high level of facial similarity between images of him and his brother's watchlist image and generated the alert; the court's account and Big Brother Watch describe officers stopping and questioning him after that match. The system's false match is the output that went wrong; the officers' decision to stop him and demand proof of identity followed from it.","status":"supported"},"person_relations":["made_claim_about","informed_decision_about"]},"name":"London: Met Police live facial recognition wrongly matched a man to his watchlisted brother; officers stopped him and he later received a settlement","summary":"On 23 February 2024 Shaun Thompson, a London community volunteer whom the 2026 judgment describes as 39, walked past a Metropolitan Police live facial recognition deployment near London Bridge station. The High Court records as not in dispute that the system detected a high level of facial similarity between images of him and the watchlist image of his brother, who was the subject of an outstanding arrest warrant, and generated an alert. According to the court's account, officers stopped, detained and questioned him and made him prove his identity, and when he declined to have his fingerprints taken he was threatened with arrest; he says the experience left him angry and distressed. Officers ended the engagement after checking police records about his brother, and he confirmed his identity with a passport photograph on his phone. Big Brother Watch, whose director was his co-claimant, says he was held for almost 30 minutes despite showing several identity documents. His judicial review claim about the stop, issued in May 2024, was withdrawn under a consent order agreed on 18 December 2024 on terms including a settlement sum paid to him. An amended challenge to the Met's revised live facial recognition policy of September 2024, brought with Big Brother Watch's director, was dismissed by the Divisional Court on 21 April 2026; the court said it was not judging the merits of the technology, and the claimants announced plans to appeal.","incidentDate":"2024-02-23","incidentKind":"single_event","incidentDatePrecision":"day","exposurePattern":"single_interaction","reportedDate":"2025-07-22","aiSystem":"The Metropolitan Police Service's live facial recognition system, which compares faces captured in public places with biometric data from a watchlist of sought persons; the judgment says the force's operational LFR used technology known as the NEC-3 algorithm","aiProduct":"Metropolitan Police live facial recognition","severity":"medium","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["loss_of_liberty","psychological_distress"],"harmOutcomeSummary":"A live facial recognition alert wrongly matched him to his brother's watchlist image; according to the High Court's account he was stopped, detained and questioned, made to prove his identity and threatened with arrest when he declined fingerprints, and he says he was left angry and distressed. Big Brother Watch says he was held for almost 30 minutes.","frameworkFacets":[],"causationStatus":"established","participantUsersAffectedMin":0,"otherPeopleHarmedMin":1,"affectedCountStatus":"exact","affectedCountEvidence":"One person: the first claimant, whose face the system matched to his brother's watchlist image and whom officers stopped. The co-claimant witnessed the stop and is not counted.","victimAgeRange":"adult","jurisdiction":"GB","platformType":"other","outcomeType":"lawsuit_dismissed","outcomeStatus":"ongoing","primarySourceUrl":"https://caselaw.nationalarchives.gov.uk/ewhc/admin/2026/915","primarySourceLabel":"R (Thompson and Carlo) v Commissioner of Police of the Metropolis [2026] EWHC 915 (Admin), 21 April 2026","firstPublishedAt":"2026-10-26T03:13:03.528278+00:00","updatedAt":"2026-10-26T03:13:03.528278+00:00","scopeVersion":"facts-v3","tags":["live-facial-recognition","police-stop","false-match","watchlist","judicial-review","settlement"]},{"id":"2025-nsw-resilient-homes-program-applicant-data-uploaded-to-chatgpt","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"Some personal information provided by people during the RHP applications process was uploaded by a former temporary employee of the RA to the AI platform, ChatGPT.","relation":"supports","source_id":"s1"},{"locator":"The data shared was contained in a Microsoft Excel spreadsheet with 10 columns and more than 12,000 rows of information.","relation":"supports","source_id":"s1"},{"locator":"The upload took place between 12 and 15 March 2025.","relation":"supports","source_id":"s1"},{"locator":"This incident occurred when a former temporary employee uploaded information from a Microsoft Excel spreadsheet to an unauthorised third-party AI platform, ChatGPT.","relation":"supports","source_id":"s1"},{"locator":"Between 12 and 15 March 2025, personal information was uploaded by a former contractor of the RA to the Artificial Intelligence platform ChatGPT.","relation":"supports","source_id":"s4"},{"locator":"\"Personal information was uploaded by a former contractor of the RA to the artificial intelligence platform ChatGPT,\" an RA spokesperson said.","relation":"supports","source_id":"s2"},{"locator":"The authority said in a breach notice that the upload “was not authorised”.","relation":"supports","source_id":"s3"}],"assertion":"Between 12 and 15 March 2025 a former temporary staff member (called a former contractor in the first notice) of the NSW Reconstruction Authority uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information (10 columns, more than 12,000 rows) to ChatGPT; the Authority says the upload was not authorised and was not a cyber-attack.","causal_attribution":"The Authority's own notices report the upload, its dates and its unauthorised status; the ABC and iTnews relay those notices. The uploader's role is a former temporary staff member on the current page and a former contractor in the first notice and the press."},{"id":"c2","status":"reported","evidence":[{"locator":"2031 people who provided information to the RA for the RHP had some of their data uploaded to ChatGPT.","relation":"supports","source_id":"s1"},{"locator":"Name and contact details","relation":"supports","source_id":"s1"},{"locator":"Residential/mailing address","relation":"supports","source_id":"s1"},{"locator":"Date of birth","relation":"supports","source_id":"s1"},{"locator":"Sensitive personal information","relation":"supports","source_id":"s1"},{"locator":"Sensitive health information","relation":"supports","source_id":"s1"},{"locator":"Limited financial commentary, but not banking or financial details","relation":"supports","source_id":"s1"},{"locator":"no driver's licence numbers, Medicare numbers, passport numbers, or Tax File Numbers were disclosed in the breach.","relation":"supports","source_id":"s1"},{"locator":"Up to 3000 individuals may be impacted by the breach.","relation":"supports","source_id":"s4"},{"locator":"The breach shared the names and addresses of program applicants, as well as email addresses, phone numbers, and other personal and health information.","relation":"supports","source_id":"s2"}],"assertion":"The Authority says external forensic analysis confirmed that 2031 people who provided information for the program had some of their data uploaded to ChatGPT, including name and contact details, residential or mailing address, date of birth, sensitive personal and health information and limited financial commentary, and that no driver licence, Medicare, passport or Tax File Numbers were disclosed; its first notice had estimated up to 3000 people.","causal_attribution":"The Authority's statements report the count and data categories from its forensic analysis; the ABC relays the first notice's categories."},{"id":"c3","status":"reported","evidence":[{"locator":"There is no evidence that any of the uploaded data is publicly available online or has been accessed by a third party at this stage.","relation":"supports","source_id":"s1"},{"locator":"We believe the risk of misuse is low","relation":"supports","source_id":"s1"},{"locator":"There is no evidence that any information has been made public, however this cannot be ruled out","relation":"supports","source_id":"s4"}],"assertion":"The Authority says there is no evidence that the uploaded data is publicly available online or has been accessed by a third party; its first notice said this could not be ruled out, and it assesses the risk of misuse as low.","causal_attribution":"The Authority's own assessment. Whether OpenAI retained, deleted or used the uploaded data is not addressed in the inspected sources."},{"id":"c4","status":"reported","evidence":[{"locator":"we are deeply sorry for the distress it may cause for those involved in the program.","relation":"supports","source_id":"s1"},{"locator":"I feel concerned — the information with the RA was deeply personal,","relation":"supports","source_id":"s2"}],"assertion":"The Authority apologised for the distress the breach may cause, and a program participant whose flooded home was bought back told the ABC the information held by the Authority was deeply personal and that they felt concerned.","causal_attribution":"The concern is one participant's stated reaction; the ABC does not say whether this person is among the 2031. No identity misuse or other realised loss is reported."},{"id":"c5","status":"reported","evidence":[{"locator":"We are working with Social Futures to reach out to people who have been impacted and ID Support NSW, a government identity and cyber security support service, to assist anyone whose data may have been compromised.","relation":"supports","source_id":"s1"},{"locator":"The NSW Reconstruction Authority will provide compensation for any reasonable out of pocket expenses if any compromised identity documents need to be replaced.","relation":"supports","source_id":"s4"}],"assertion":"The Authority contacted affected people with ID Support NSW and Social Futures to offer support, and said it would compensate reasonable out-of-pocket expenses if compromised identity documents needed replacing.","causal_attribution":"The Authority's statements about its response."},{"id":"c6","status":"reported","evidence":[{"locator":"We are working with Cyber Security NSW to monitor the internet and dark web to see if any of this information is accessible online. The NSW Privacy Commissioner has also been notified.","relation":"supports","source_id":"s1"},{"locator":"The RA has also implemented controls to block the upload of personal information into AI tools.","relation":"supports","source_id":"s1"},{"locator":"An independent review into the data breach has now been completed, identifying several areas for improvement in RA’s governance, training and data security practices.","relation":"supports","source_id":"s1"}],"assertion":"The Authority notified the NSW Privacy Commissioner, had Cyber Security NSW monitor the internet and dark web, implemented controls to block the upload of personal information into AI tools, and completed an independent review that identified areas for improvement in its governance, training and data security practices.","causal_attribution":"The Authority's own account of its response; the review report itself was not inspected."},{"id":"c7","status":"reported","evidence":[{"locator":"The AI-related data breach was disclosed on what is a public holiday Monday in NSW, although it actually occurred over six months ago, between March 12 and 15.","relation":"supports","source_id":"s3"},{"locator":"said she received a preliminary report about the breach in July, and the final report on Friday.","relation":"supports","source_id":"s2"},{"locator":"\"I would prefer [for the RA] to advise people sooner, and I'm also informed they couldn't identify everybody, but I need to see the report first,\" she said.","relation":"supports","source_id":"s2"}],"assertion":"The breach was disclosed publicly on 6 October 2025, more than six months after the upload; the NSW Minister for Recovery told the ABC she had received a preliminary report about the breach in July and would have preferred people to be advised sooner.","causal_attribution":"iTnews's own observation of the disclosure timing and the Minister's statement to the ABC; the Authority attributes the delay to the time needed to identify affected people."}],"effects":[{"label":"personal and sensitive information of 2031 Resilient Homes Program participants was uploaded to ChatGPT without authorisation","claim_id":"c2","direction":"negative"},{"label":"a program participant reports concern about the deeply personal information held; the Authority apologised for possible distress","claim_id":"c4","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/resilient-homes-program-data-breach","kind":"official_statement","access":"read","language":"en","translation_note":"English original; full body read by curl on 2026-10-11 (page last updated 26 March 2026, with the 9 December 2025 update and FAQ on the same page).","independence_group":"nsw-ra-statement"},{"id":"s2","url":"https://www.abc.net.au/news/2025-10-06/data-breach-northern-rivers-resilient-homes-program-chatgpt/105855284","kind":"news_report","access":"read","language":"en","translation_note":"English original; full body read by curl on 2026-10-11. Relays the Authority statement; the participant and the Minister were interviewed separately within the same article.","independence_group":"nsw-ra-statement"},{"id":"s3","url":"https://www.itnews.com.au/news/nsw-gov-contractor-uploaded-excel-spreadsheet-of-flood-victims-data-to-chatgpt-620815","kind":"news_report","access":"read","language":"en","translation_note":"English original; full body read by curl on 2026-10-11. Relays the Authority breach notice; the disclosure-timing observation is the outlet's own.","independence_group":"nsw-ra-statement"},{"id":"s4","url":"https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/media-releases/northern-rivers-resilient-homes-program-data-breach","kind":"official_statement","access":"read","language":"en","translation_note":"English original; full body read by curl on 2026-10-11. Authority departmental release of the first notice, 6 October 2025.","independence_group":"nsw-ra-statement"}],"version":1,"ai_roles":["institutional_use"],"contexts":["privacy","public_services"],"unknowns":["Why the staff member uploaded the spreadsheet and what, if anything, was asked of ChatGPT; no ChatGPT output is described.","Whether OpenAI retained, deleted or used the uploaded data for training; the sources establish the upload to the service only.","Whether any participant suffered identity misuse or other realised loss; none is reported.","Whether the uploader was a temporary staff member or a contractor (the Authority uses both terms), and how many separate uploads occurred between 12 and 15 March 2025.","The findings of the independent review beyond the Authority's summary of it."],"geography":{"basis":"The data was held by the NSW Reconstruction Authority, a New South Wales government agency, and was uploaded by a former temporary staff member of that agency; the Authority describes the incident as a breach of its program data. The ABC describes the affected people as northern NSW residents of the Northern Rivers region. No court is involved.","court_countries":[],"event_countries":["AU"],"affected_person_countries":["AU"]},"publication":{"basis":"The Authority's notices, read in full on 2026-10-11, state that a staff member uploaded program participants' personal and sensitive information to ChatGPT without authorisation and that forensic analysis confirmed 2031 affected people. The disclosure of their information to a generative AI service without their knowledge is the recorded privacy harm. The upload rests on the Authority's own account, which the press relayed; no retention, training, public exposure or misuse is established. The uploader and affected people are not named.","reviewed_on":"2026-10-11"},"ai_involvement":{"basis":"The Authority states that a former temporary staff member uploaded a spreadsheet of program information to ChatGPT between 12 and 15 March 2025, that the upload was not authorised, and that forensic analysis confirmed 2031 people had some of their data uploaded. The reported transfer of their personal and sensitive information into the generative AI service is the AI connection to the privacy harm. This establishes the upload only. It does not establish retention by OpenAI, use for training, public exposure or a finding of illegality, and no ChatGPT output affecting participants is described.","status":"supported"},"person_relations":["received_personal_information"]},"name":"NSW Reconstruction Authority says a former temporary staff member uploaded 2031 Resilient Homes participants' personal data to ChatGPT without authorisation","summary":"The NSW Reconstruction Authority says that between 12 and 15 March 2025 a former temporary staff member (called a former contractor in its first notice) uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information, 10 columns and more than 12,000 rows, to ChatGPT, an AI platform the Authority had not authorised. The Authority disclosed the breach on 6 October 2025, estimating that up to 3000 people were affected, and later said external forensic analysis confirmed that 2031 people had some of their data uploaded, including names, contact details, addresses, dates of birth, sensitive personal and health information and limited financial commentary. It says no driver licence, Medicare, passport or Tax File Numbers were disclosed and that there is no evidence the data is publicly available or was accessed by a third party; whether OpenAI retained or used the data is not addressed. The Authority apologised, contacted affected people with ID Support NSW, offered to compensate the replacement of compromised identity documents and notified the NSW Privacy Commissioner. A program participant told the ABC the information was deeply personal and that they felt concerned. No misuse of the data is reported.","incidentDate":"2025-03-12","incidentEndDate":"2025-03-15","incidentKind":"bounded_series","incidentDatePrecision":"range","exposurePattern":"unknown","reportedDate":"2025-10-06","aiSystem":"ChatGPT (OpenAI), used through an unauthorised upload of program data by a person working for the NSW Reconstruction Authority","aiProduct":"ChatGPT","aiCompany":"OpenAI","severity":"low","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"The NSW Reconstruction Authority reports that personal and sensitive information of 2031 Resilient Homes Program participants was uploaded to ChatGPT without authorisation, a loss of privacy for those people; it reports no evidence of public exposure or third-party access, and no misuse is reported (the Authority's notices and press coverage relaying them).","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":0,"otherPeopleHarmedMin":2031,"affectedCountStatus":"exact","affectedCountEvidence":"The Authority states that external forensic analysis confirmed 2031 people had some of their data uploaded to ChatGPT. The upload of their personal information to the AI service is itself the privacy harm recorded, so those 2031 people are counted as other people harmed. The first notice's estimate of up to 3000 is not used; the 12,000 rows are rows, not people. The participant quoted by the ABC is not separately counted because the ABC does not say whether that person is among the 2031. The uploader is not counted.","victimAgeRange":"unknown","jurisdiction":"AU-NSW","platformType":"chatbot","outcomeType":"investigation_opened","outcomeStatus":"resolved","primarySourceUrl":"https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/resilient-homes-program-data-breach","primarySourceLabel":"NSW Reconstruction Authority, updated 26 March 2026: Resilient Homes Program data breach","firstPublishedAt":"2026-09-29T12:41:19.196147+00:00","updatedAt":"2026-10-11T03:10:38.11789+00:00","scopeVersion":"facts-v3","tags":["historical-2025"]}]}