Relying on AI output about a real, named person
When a model invents a crime and attaches a real person's name to it, that is not a glitch. Under data law it is an accuracy violation.
Not legal advice. Sally roasts behaviour and use-cases in general, never your specific situation, and nothing here replaces a real lawyer. The cases are real; what you do about them is between you and someone licensed to tell you.
Treating an AI's confident statements about a named individual as fact, or publishing them.
noyb v. OpenAI (Holmen complaint)
Complaint filed Mar. 2025 (Danish DPA) · EU (data protection complaint)
ChatGPT falsely told a Norwegian man he had murdered two of his sons and served 21 years, blended with true personal details.
Pending before data protection authorities, alleging breach of GDPR accuracy duties and the right to rectification. Cite as unresolved.
A model once told a real man he had murdered his own children and served decades in prison, mixed in with true details like his actual hometown and family. Under EU data law this is not just defamation. It is a data-accuracy problem, and the inability to correct or erase the falsehood is itself a violation of the right to rectification.
This area is still being decided, which is the point. The accuracy and rectification obligations attach to AI-generated statements about people the same way they attach to a database record, and "the model said it" does not discharge them.
“It got his hometown right and his entire criminal history invented, which is somehow worse than getting all of it wrong.”
- 01Never publish or act on AI claims about a specific person without independent confirmation from a real source.
- 02Build a correction path. If your system states facts about people, people need a way to fix them.
- 03Treat confident detail about a named individual as the highest-risk output a model can produce.
Not legal advice. General commentary on a use-case, not your situation. Talk to a real lawyer before you act.