A privacy campaign group on Monday filed a complaint with Lithuanian authorities against Whitebridge AI, accusing it of illegally collecting and selling personal data via “reputation reports” generated by artificial intelligence.
Prominent Vienna-based organisation, Noyb — whose name stands for “none of your business” — said the company marketed its services as an AI tool that “will find everything about you online”, offering “reputation reports” to “anyone willing to pay”.
These reports illegally “compile large amounts of scraped personal information about unsuspecting people”, including “AI-generated” data that is “not factual”, Noyb said.
The AI-generated information includes “alleged personality traits”, background checks and data about “political or religious content”.
“It seems the business model is largely based on scared users that want to review their own data that was previously unlawfully compiled,” Noyb said in a statement.
“The amount of personal data that Whitebridge AI processes is downright spooky,” said Noyb lawyer Aitana Pallas.
“This is made even worse by the fact that Whitebridge AI completely ignores data subjects when they try to exercise their rights.
Noyb said two complainants had requested access to the data about themselves, which contained “false warnings” about “sexual nudity” and “dangerous political content”.
Their requests — including for rectification of “false data” — were either ignored or rebuffed by the Lithuania-based company.
The complaint cites several violations of the European General Data Protection Regulation (GDPR) relating to the processing of their data and their right of access and rectification.
Every European citizen has the right to access their personal data free of charge.
The NGO has asked the Lithuanian data protection authority to compel Whitebridge to comply with the access requests, to stop the illegal processing of data and to impose a fine.
Noyb has launched several legal cases against US technology giants such as Meta and Google, often prompting action from regulatory authorities over violations of the GDPR.
