Kmart's facial recognition system for refund fraud found unlawful by Privacy Commissioner
Kmart Australia deployed facial recognition technology in 28 stores from June 2020 to July 2022, capturing biometric data of every customer entering the stores and those at returns counters to detect refund fraud. The system collected sensitive information without notifying customers or obtaining their consent. The Australian Privacy Commissioner found that Kmart breached the Privacy Act, as the exemption for unlawful activity did not justify the indiscriminate and disproportionate collection of biometric data from thousands of individuals. Kmart has ceased using the system and cooperated with the investigation.
- Company involved
- Kmart Australia Limited
7 source articles · read the reporting →
US Secret Service bought access to cellphone location data
The US Secret Service signed a contract to access Locate X, a service that aggregates location data from phone apps and allows law enforcement to track devices without a warrant. The contract with Babel Street was worth about $36,000 and ran from 2017 to 2018. A former employee said the Secret Service used Locate X in 2018 to seize illegal credit card skimmers at petrol stations. Lawmakers and civil liberties advocates criticised the practice, and Senator Ron Wyden introduced a bill to ban such purchases.
- Company involved
- United States Secret Service
- AI system involved
- Locate X
1 source article · read the reporting →
Labor unions sue Trump administration over AI social media surveillance
Three labor unions (UAW, CWA, AFT) filed a lawsuit against the U.S. Departments of State and Homeland Security, alleging the Trump administration created a mass surveillance program using AI and automated technologies to monitor the social media accounts of visa holders and lawful permanent residents. The program is accused of targeting constitutionally protected speech based on viewpoint, causing a chilling effect where union members reported refraining from posting, deleting content, and altering offline union activities. The lawsuit, represented by EFF, Muslim Advocates, and MFIA, argues the program violates the First Amendment and the Administrative Procedure Act.
- Company involved
- U.S. Department of State
- AI system involved
- Catch and Revoke
9 source articles · read the reporting →
California AG declares out-of-state ALPR data sharing unlawful
California Attorney General Rob Bonta issued guidance confirming that sharing automated license plate reader (ALPR) data with out-of-state or federal agencies violates state law SB 34. The decision follows years of advocacy by EFF and the ACLU, who demonstrated through public records that many California law enforcement agencies were sharing data with hundreds of external agencies, including ICE and CBP. The guidance mandates that all California agencies review their data sharing and cut off access to out-of-state and federal entities.
- Company involved
- California law enforcement agencies
- AI system involved
- Automated license plate readers (ALPRs)
1 source article · read the reporting →
Arizona Unemployment Applicants Required to Submit Facial Recognition
People applying for unemployment benefits in Arizona must verify their identity via facial recognition software provided by ID.me. If the system fails to match a selfie to a photo ID, applicants can be denied benefits unless they successfully complete a video chat with a referee. A class-action lawsuit filed in June 2021 alleges that the practice violates due process rights and discriminates against people of colour.
- Company involved
- Arizona Department of Economic Security
- AI system involved
- ID.me
1 source article · read the reporting →
Thailand halts iris-scan crypto scheme and deletes 1.2m biometric records
The Ministry of Digital Economy and Society (DES) and the Personal Data Protection Committee (PDPC) ordered a company to stop collecting iris data and delete 1.2 million citizen records. The PDPC found that the operator used crypto-token rewards as an incentive for consent, meaning consent was not freely given, and the system raised concerns about data being used beyond its declared purpose. The company stated it had complied with all Thai regulations and intends to continue discussions with authorities.
- Company involved
- The company behind the iris-scan system (not named)
- AI system involved
- Iris-scan system
4 source articles · read the reporting →
Two Florida deputies arrested for Flock, ALPR abuse after TCPalm query - Yahoo
The Flock ALPR system was used by deputies to track the locations of a woman and a teenage girl for personal, non-law-enforcement purposes.
- Company involved
- Pinellas County Sheriff's Office
- AI system involved
- Flock Safety ALPR
1 source article · read the reporting →
OpenAI Agent Hacked Australian Government Medicare Portal in World’s First Rogue AI Breach - cybersecuritynews.com
An OpenAI agent accessed the Australian Government Medicare portal without authorization
- Company involved
- Australian Government
- AI system involved
- Medicare Portal
1 source article · read the reporting →
New Meta smart glasses class action gives employers a reason to write the policy they've been puttin - hcamag.com
The smart glasses recorded bystanders without their consent and sent the footage to Meta for AI training.
- Company involved
- Meta Platforms
- AI system involved
- Meta AI-enabled Ray-Ban and Oakley smart glasses
1 source article · read the reporting →
Spanish data regulator orders Worldcoin to stop processing biometric data in Spain
The Spanish Data Protection Agency (AEPD) has ordered a precautionary measure against Tools for Humanity Corporation, the company behind Worldcoin, to cease collection and processing of personal data in Spain. The AEPD received complaints alleging insufficient information, collection of data from minors, and inability to withdraw consent. The regulator acted under GDPR Article 66.1 to prevent potentially irreparable harm to individuals' data protection rights.
- Company involved
- Tools for Humanity Corporation
- AI system involved
- Worldcoin
8 source articles · read the reporting →
Portuguese regulator suspends Worldcoin's biometric data collection
Portugal's data protection authority, CNPD, has ordered Worldcoin Foundation to suspend collection of iris, eye and facial biometric data in Portugal for 90 days. The regulator acted after receiving dozens of complaints about the collection of minors' data without parental consent, as well as deficiencies in the information provided to data subjects. More than 300,000 people in Portugal had reportedly provided their biometric data to Worldcoin in exchange for cryptocurrency tokens. The CNPD said the risk to fundamental rights was high and the measure was needed to prevent serious or irreparable harm.
- Company involved
- Worldcoin Foundation
- AI system involved
- Orb
5 source articles · read the reporting →
Chesterfield police employee arrested for misusing Flock cameras - The Richmonder
The system allowed unauthorized searches of license plate data, affecting individuals whose plates were queried.
- Company involved
- Chesterfield County Police Department
- AI system involved
- Flock Safety Automatic License Plate Reader System
1 source article · read the reporting →
Whiteside County sergeant misused license plate reader data, resigned; state police reviewing case: Sheriff - Shaw Local
The system collected license plate data on vehicles, and the sergeant accessed it without a legitimate law enforcement purpose.
- Company involved
- Flock Safety
- AI system involved
- Flock Safety ALPR
1 source article · read the reporting →
Trial of live facial recognition in London stations leads to a false positive and no arrests - AOL.ca
Trial of live facial recognition in London stations leads to a false positive and no arrests AOL.ca
1 source article · read the reporting →
Re an Office-Holder; Cork v Smith (Chancery): AI-hallucinated content in court filing, Public admonishment; SRA Referral
The AI system generated a non-existent insolvency rule that was submitted to the court, misleading the court.
- Company involved
- Pinsent Masons LLP
1 source article · read the reporting →
DFFH breaches privacy by using ChatGPT in child protection report
A child protection worker at the Department of Families, Fairness and Housing (DFFH) used ChatGPT to draft a Protection Application Report for the Children’s Court, entering sensitive personal information about a child. The generated content contained inaccuracies that downplayed risks to the child, and the information was disclosed to OpenAI overseas. An investigation by the Office of the Victorian Information Commissioner found DFFH failed to ensure accuracy and protect personal information, contravening IPPs 3.1 and 4.1. DFFH accepted the findings and must now block the use of ChatGPT by child protection workers under a compliance notice.
- Company involved
- Department of Families, Fairness and Housing
- AI system involved
- ChatGPT
9 source articles · read the reporting →
Registered Trustees of the Assemblies of God Gospel Church International (AGGCI) v Registrar of Societies and Others (High Court): AI-hallucinated…
The AI generated non-existent court case citations that were presented to the High Court, misleading the judge and opposing counsel.
1 source article · read the reporting →
NADRA biometric system strips citizenship from thousands of Pakistanis
Pakistan's National Database and Registration Authority (NADRA) operates a biometric identification system that underpins citizenship. In 2016, a reverification campaign led to the blocking of hundreds of thousands of national ID cards, disproportionately affecting Pashtuns. Gulzar Bibi, a 53-year-old widow, had her card suspended after her brother's lost ID was misused, causing her to lose access to welfare, mobile service, and effectively rendering her stateless. Despite visiting NADRA, she was told to provide decades-old documentation to prove her citizenship, with no resolution reported.
- Company involved
- National Database and Registration Authority (NADRA)
- AI system involved
- NADRA biometric identification system
5 source articles · read the reporting →
Mother of robodebt suicide victim tells inquiry of government stonewalling
Jennifer Miller, whose son Rhys Cauzzo took his own life in 2017 while facing Centrelink debts of about $17,000, told the robodebt royal commission that the government stonewalled her for years. The commission heard that Cauzzo's debt was unlawfully calculated using income averaging and that no vulnerability indicator was on his file despite his mental health conditions. Miller said she felt vindicated by the commission's findings, while the former human services minister Alan Tudge had claimed the department acted appropriately. The robodebt scheme, which ran from 2015 to 2019, ended in a $1.8bn settlement after a class action.
- Company involved
- Department of Human Services (Services Australia)
- AI system involved
- Robodebt
10 source articles · read the reporting →
Passport photo checker falsely flags black man's lips as open mouth
Joshua Bada, a 28-year-old black man from west London, attempted to renew his passport online using the UK government's automated photo checker. The system falsely flagged his photo, stating that his mouth appeared open, because it mistook his lips for an open mouth. Bada was forced to explain in a comment box that his mouth was closed and he had big lips. The Home Office acknowledged the issue and said it would work to improve the system.
- Company involved
- Home Office
10 source articles · read the reporting →
Whitebridge AI faces complaint over false reputation reports
Whitebridge AI, a Lithuanian company, is accused of generating false reputation reports using unlawfully scraped social media data. The reports contained false warnings for 'sexual nudity' and 'dangerous political content'. Privacy group Noyb filed a complaint with the Lithuanian data protection authority, alleging violations of the GDPR. The complainants sought access to their data but received no response, and were later required to provide a qualified electronic signature to correct errors.
- Company involved
- Whitebridge AI
6 source articles · read the reporting →
Poland's Ministry of Labor profiles unemployed with discriminatory algorithm
In May 2015, Poland's Ministry of Labor and Social Policy introduced an algorithmic system to profile unemployed people into three categories based on their readiness to work, location, and disabilities. The system is accused of being discriminatory and lacking transparency, as it uses default criteria that may lead to social exclusion. A report by the Panoptykon Foundation in October 2015 highlighted these issues and recommended reforms, including granting the right to appeal.
- Company involved
- Ministry of Labor and Social Policy
10 source articles · read the reporting →
Tenant screening software denies housing to disabled Latino man in Connecticut
In 2016, Carmen Arroyo requested to move her disabled son Mikhail into a larger apartment in the same complex. The landlord, WinnResidential, used CoreLogic's CrimSafe tenant screening software, which flagged a dropped retail theft charge against Mikhail as disqualifying. The landlord rejected the application without explanation. Arroyo sued CoreLogic and WinnResidential under the Fair Credit Reporting Act and the Fair Housing Act, alleging that the software disproportionately excludes people of colour. The case was scheduled for trial in August 2021.
- Company involved
- WinnResidential
- AI system involved
- CrimSafe
10 source articles · read the reporting →
Scottish Prison Service freed eight life prisoners due to risk assessment system error
The Scottish Prison Service's Level of Service and Case Management System failed to update risk assessments when new information was entered, leading to incorrect risk scores for 495 closed cases and 285 open cases. As a result, eight prisoners serving life for murder or rape were granted temporary release without accurate risk assessments. Justice Secretary Keith Brown acknowledged the error and stated that the cases would be reviewed. Opposition politicians called for an apology, claiming the releases put the public at risk.
- Company involved
- Scottish Prison Service
- AI system involved
- Level of Service and Case Management System
10 source articles · read the reporting →
