Southern Co-op uses facial recognition with Hikvision cameras
Southern Co-op, a UK grocery chain, deployed a facial recognition system using Hikvision cameras in its stores. The system is used to identify and track customers, but the grocer did not inform customers or obtain their consent. Privacy advocates have raised concerns about compliance with GDPR and ethical risks. The grocer has stated it is committed to a high standard of privacy.
- Company involved
- Southern Co-op
4 source articles · read the reporting →
OAIC finds 7-Eleven breached privacy with facial recognition surveys
The Australian Information Commissioner found that 7-Eleven interfered with customers' privacy by collecting facial images and creating faceprints through in-store surveys without adequate notice or consent. The system was used to exclude non-genuine responses and profile demographics. The OAIC ordered 7-Eleven to destroy the collected data and cease the practice.
- Company involved
- 7-Eleven
9 source articles · read the reporting →
Proctortrack data breach exposed student data from online proctoring
Proctortrack, an online proctoring service used by universities, suffered a data breach in September 2020 when its source code was leaked online. An analysis by Consumer Reports found that the code contained hard-coded passwords and exposed the names and email addresses of over 150 students. The company acknowledged the leak but said no harm resulted. Students had been required to use the software, which performed facial recognition and recorded video during exams.
- Company involved
- Proctortrack
- AI system involved
- Proctortrack
10 source articles · read the reporting →
Verkada security breach exposes customer video and data
In March 2021, attackers compromised Verkada's platform and accessed video and image data from 97 customer organisations. The attackers used a misconfigured customer support server to gain access and viewed live video, accessed badge credentials for eight customers, and downloaded user lists. Verkada cut off access within hours and notified affected customers. The attacker, Tillie Kottmann, was later indicted by the U.S. Department of Justice.
- Company involved
- Verkada
- AI system involved
- Verkada Command platform with People Analytics
10 source articles · read the reporting →
Kohler, BMW, MaxMara secretly collected customers' facial recognition data
During the 2021 CCTV 3·15 Gala, it was revealed that Kohler, BMW, and MaxMara stores had installed facial recognition cameras from vendors such as Wandianzhang and Youluoke. These cameras captured customers' facial data without their knowledge or consent, and the data was used to track customer visits and inform sales strategies. The systems were deployed in thousands of stores across China, collecting over 100 million facial records. The companies did not inform customers or obtain consent, violating Chinese privacy laws.
- Company involved
- Kohler (China) Investment Co., Ltd., ZhengTong Auto (BMW dealerships), MaxMara
- AI system involved
- Facial recognition cameras from Wandianzhang, Youluoke, Yaliang, Ruiwei
10 source articles · read the reporting →
CBSE introduces facial recognition system for students to access digital documents
The Central Board of Secondary Education (CBSE) has introduced a facial recognition system for Class 10 and 12 students to access their digital academic documents. A live image of the student is compared with the photograph on their CBSE admit card and, if the match succeeds, the certificate is emailed to them. The facility is available on Digi Locker for 2020 records and is expected to help foreign students and those unable to open a Digi Locker account.
- Company involved
- Central Board of Secondary Education (CBSE)
- AI system involved
- Facial Recognition System
10 source articles · read the reporting →
Erin Booker v. The Kroger Co. (N.D. Georgia): AI-hallucinated content in court filing, Monetary Sanctions; CLE
The court imposed monetary sanctions and continuing legal education requirements on plaintiff's counsel for using AI-generated fake legal authorities in a court filing.
1 source article · read the reporting →
Barteca Holdings v. Tacobarn (D. Connecticut): AI-hallucinated content in court filing, Monetary Sanction; Bar Referral
The attorney filed a court document containing AI-hallucinated legal authorities, misleading the court and opposing party.
- Company involved
- Hilary Miller
1 source article · read the reporting →
McCormick v. Texakoma Financial (E.D. Texas): AI-hallucinated content in court filing, Public Reprimand; Monetary Sanction; Firmwide citation review; CLE
The AI generated fictitious legal citations and quotes that were included in a court filing, misleading the court and opposing counsel.
- Company involved
- Ginsburg Law Group, P.C.
1 source article · read the reporting →
Thomas Raynard James v. Detective Kevin Conley, et al. (S.D. Florida): AI-hallucinated content in court filing, Bar Referral
AI generated hallucinated content in a court filing, affecting the legal process and the lawyers who filed it.
1 source article · read the reporting →
Plastic Forte fined for using facial recognition on workers without notice
The Spanish data protection agency AEPD fined Plastic Forte, a plastics manufacturer in Alicante, €20,000 for using facial recognition to record employees' working hours without informing them. A worker requested information about his personal data and discovered the biometric processing. The company initially argued it was only for time tracking but later acknowledged responsibility, resulting in a reduced fine of €12,000. The AEPD deemed facial recognition for time control as highly intrusive and requiring prior impact assessment.
- Company involved
- Plastic Forte
7 source articles · read the reporting →
Mercadona fined €2.5 million for facial recognition pilot
Mercadona, a Spanish supermarket chain, tested an early-detection system using facial recognition in 48 stores to identify people with judicial restraining orders. The system, which operated with court authorisation, notified police when such a person was detected. The Spanish data protection authority (AEPD) imposed a €2.5 million fine, which Mercadona paid, and the company has since removed the system citing legal uncertainty.
- Company involved
- Mercadona
- AI system involved
- Sistema de Detección Anticipada (Early Detection System)
10 source articles · read the reporting →
TOV Realty, LLC v. Suarez; Kosel Equity, LLC v. MacGregor (SC Connecticut): AI-hallucinated content in court filing, 6 hours CLE;…
The AI generated legal briefs containing fabricated citations, which were submitted to the Connecticut Supreme Court.
- Company involved
- GLG Law LLC
- AI system involved
- ChatGPT
1 source article · read the reporting →
Met Police buys £3m retrospective facial recognition system
The Metropolitan Police Service (MPS) has awarded a £3 million, four-year contract to Northgate Public Services for a new retrospective facial-recognition (RFR) system to be deployed within three months. RFR processes biometric information from historic CCTV, social media, and other images to identify suspects and missing persons, operating retroactively unlike live facial recognition. The procurement was approved by the Mayor's Office for Policing and Crime in August 2021. The MPS states that human-in-the-loop decision-making will be used, but digital rights groups and a former biometrics commissioner have raised concerns about potential discrimination, overrepresentation of marginalised groups in watch lists, and lack of a legislative framework.
- Company involved
- Metropolitan Police Service
- AI system involved
- Retrospective facial-recognition software
9 source articles · read the reporting →
In re Rosslyn2016, LLC, et al. (S.D. Texas (Bankruptcy)): AI-hallucinated content in court filing, CLE on generative AI; Civil Contempt;…
The AI generated fabricated legal citations that were submitted to the bankruptcy court.
1 source article · read the reporting →
New Jersey court rules police must disclose facial recognition algorithms used to identify defendant
Francisco Arteaga was charged with armed robbery after a facial recognition search by the New York Police Department identified him as a possible match. The New Jersey police used this match to obtain witness identifications. Arteaga requested information about the facial recognition software, including its source code and error rate, but the trial court denied his request. The New Jersey appellate court ruled that the prosecution must disclose the algorithms, citing due process and the Brady rule.
- Company involved
- New Jersey Police
7 source articles · read the reporting →
In re BFI Waste Sys. of Tenn. (M.D. Tennessee): AI-hallucinated content in court filing, Public reprimand; Monetary sanction
The AI generated false legal quotations that were submitted to the court in a legal brief.
- Company involved
- Ringger
1 source article · read the reporting →
Reaves Law Firm, PLLC v. Baker, Donelson, Bearman, Caldwell & Berkowitz, PC, et al. (W.D. Tennessee): AI-hallucinated content in court…
The AI generated fictitious legal authorities and arguments that were filed in a court motion, misleading the court and opposing counsel.
- Company involved
- Reaves Law Firm, PLLC
1 source article · read the reporting →
WorldCoin suspended in Kenya over data security concerns
WorldCoin, a digital identification protocol using iris scans, was suspended by Kenyan regulators (ODPC and Communications Authority) over concerns about data security, consent, and oversight. The system had issued digital IDs and cryptocurrency tokens to over 350,000 Kenyans. Reports of hacked orb operators and iris scans traded on the dark web have also emerged.
- Company involved
- Tools for Humanity GmbH
- AI system involved
- WorldCoin
10 source articles · read the reporting →
ООО «Точка опоры» v. ООО «ЦСС» (West Siberian District AC): AI-hallucinated content in court filing, Monetary Fine
The AI system generated fake legal citations that were submitted to the court, resulting in a fine for contempt.
- Company involved
- ООО «ЦСС»
1 source article · read the reporting →
DeepSeek exposed user data via open ClickHouse database
Cloud security firm Wiz discovered a ClickHouse database belonging to DeepSeek that was open to the internet without authentication, containing over a million lines of logs with chat histories, secret keys and backend details. Wiz disclosed the breach to DeepSeek, which promptly locked down the database. The incident highlights security risks in rapidly deploying AI services.
- Company involved
- DeepSeek
- AI system involved
- DeepSeek-R1
5 source articles · read the reporting →
Bavarian police test Palantir data mining with real personal data
The Bavarian State Criminal Police Office (LKA) has been testing Palantir's data mining software, called VeRa, with real personal data for months. The Bavarian data protection commissioner only learned of the test through a media inquiry and has announced a review. The Interior Ministry claims the test is lawful under current law, but critics argue a legal basis is missing.
- Company involved
- Bayerisches Landeskriminalamt
- AI system involved
- VeRa
7 source articles · read the reporting →
Serco Leisure issued enforcement notices for unlawful biometric monitoring of employees
Serco Leisure and associated trusts used facial recognition and fingerprint scanning to monitor employee attendance at 38 leisure facilities. The ICO found they unlawfully processed biometric data of over 2,000 employees. Enforcement notices were issued ordering them to stop.
- Company involved
- Serco Leisure Operating Limited
8 source articles · read the reporting →
Worldcoin collected biometric data from poor villagers in Indonesia without informed consent
Worldcoin, a cryptocurrency startup, recruited users in developing countries by offering free cash in exchange for iris scans. The company used deceptive marketing, collected more personal data than acknowledged, and failed to obtain meaningful informed consent. Many users received worthless tokens instead of promised money. The company acknowledged some friction but continued its operations.
- Company involved
- Worldcoin
- AI system involved
- chrome orb
5 source articles · read the reporting →
