FARO stands for Frontline Record of Online Harms. Technology-related harm usually reaches the public one case at a time: a school in one country, a family in another, each easy to treat as an exception. This directory puts those cases side by side to help grassroots actors see where others face the same issues they do, and to help governments and regulators see the bigger picture of the harms occurring. The directory describes what its records contain. It does not measure how often these harms occur, and a country with few records may simply have little published about it.
How to use this directory: Topics are filterable for FARO reports that have already been created based on these incidents. The harms and response patterns shown are those featured there. To see the incidents used in a country-specific report, choose that country under Country report. Pick a pattern or evidence type to see on the map which countries have matching records. Click a country on the map or in the list to see its records below. Use the filter to search for keywords or specific sources.
Shaded countries have at least one record. Choose a pattern to see where it appears.
Shading shows only that a country has at least one record in this directory that matches your selection, and every shaded country looks the same on purpose. It says nothing about how often these harms occur there. Pattern filters only cover records classified so far, and small countries are easy to miss on a map, so use the list as well.
In the list but not drawn on the map: Multiple countries, Not stated.
A child became fearful of digital harassment after misuse of a publicly identifiable YouTube account. This is a personal interview. Source available to SHIELD.
Children received devices with visible login credentials attached via stickers. This is a personal interview. Source available to SHIELD.
The Danish Data Protection Authority (Datatilsynet) issued a formal reprimand to Copenhagen Municipality (Københavns Kommune) regarding its use of the school communication platform Aula. The regulator determined that the municipality failed to conduct a compliant data protection impact assessment and did not fully demonstrate that appropriate security measures were implemented to mitigate risks such as unauthorized access. The investigation followed public reports that the municipality had been utilizing the platform's secure file-sharing module to store sensitive child welfare and health records without performing the necessary risk assessments.
View sourceThe Danish Data Protection Authority (Datatilsynet) issued formal reprimands and enforcement orders to five Danish municipalities—Lolland, Esbjerg, Hillerød, Randers, and Frederikshavn—following an audit of their security practices on the school communication platform AULA. The regulator found that the municipalities failed to document adequate risk assessments and did not meet the minimum requirements for Data Protection Impact Assessments (DPIAs). As a consequence, the municipalities received formal criticism, and two were ordered to complete compliant DPIAs within three months.
View sourceA Danish municipality deployed Google Chromebooks and G Suite for Education in its municipal schools without conducting required risk assessments or ensuring proper privacy configurations. Consequently, the personal data of pupils was processed in violation of the GDPR, exposing them to risks of unauthorized data profiling and sharing. The Danish Data Protection Authority issued a serious criticism against the municipality and ordered it to bring its data processing practices into compliance.
View sourceThe Danish Data Protection Authority (Datatilsynet) upheld a ban prohibiting a municipality in Denmark from processing pupil and teacher personal data using Google Workspace and Chromebooks due to high privacy risks. The regulator determined that the municipality had failed to adequately analyze and mitigate data transfer and security risks, particularly concerning potential unauthorized data processing by the technology provider. As a consequence of the ban, teachers and pupils at municipal schools were blocked from using their primary digital teaching and learning tools at the start of the 2022/2023 school year, severely disrupting planned educational activities.
View sourcePublic school students in a municipality in Denmark had their personal information, including full names, schools, and grades, publicly exposed on YouTube and Gmail due to the municipality's misconfiguration of school-issued Chromebooks and G Suite for Education accounts. In several cases, the real names of students with legally protected identities were exposed instead of anonymous aliases. Additionally, the municipality taped login credentials directly onto some students' laptops, compromising account security and confidentiality.
View sourceAn adult high school teacher's name, detailed work hours, schedule, and absence records were publicly exposed on a school administration platform without password protection by their employer. The teacher complained that the public availability of their detailed schedule created a safety risk by allowing anyone to know when they would be away from home, potentially exposing them to burglaries. The Danish Data Protection Authority ruled on the complaint, finding that the school's interest in publishing the schedule was legitimate under the applicable data protection laws.
View sourceA ransomware-infected laptop was connected to the school network of five educational institutions in Denmark. This allowed unauthorized third parties to compromise the network and publish the private personal data of over 10,000 students on the dark web.
View sourceA parent discovered that their child's personal data was made public through a student account configured on a technology company's hardware and software platform. In response, the parent initiated a campaign that ultimately resulted in a national data protection authority issuing an injunction against schools using the platform to collect and process student personal data.
View sourceIn 2019, a public school in Denmark required students to use school-provided laptops and set up public profiles on a video-sharing platform. This resulted in the public exposure of a student's personal details, including their full name, age, school name, and class, without parental consent.
View sourceStudents in public schools across several Danish municipalities had their personal data unlawfully transmitted to Google. The municipalities deployed Google Chromebooks and Workspace for Education for schoolwork, which resulted in the continuous collection and transfer of students' personal data to Google for its own purposes, such as product improvement and performance measurement. The Danish Data Protection Authority (Datatilsynet) ruled that there was no legal basis for these transfers under Danish education law or the GDPR, issuing orders to the municipalities to bring the processing into compliance.
View sourceEach record is a short summary of an incident described in a public source or collected through an interview by SHIELD or its partners. Records are reviewed by people before they appear here. Names and identifying details are removed: where a person appears, a role, age band and gender stand in for the name, and dates and places for minors are generalised. Every record links to its original source and shows the date that link was last checked. Records are classified with shared harm categories. The classification is SHIELD's own, so it can differ from how a source describes the incident.
You are welcome to read, link to and quote individual records with credit to FARO. Please do not copy, scrape or republish the dataset in bulk, or use it to train or test automated systems, without written permission. To ask for permission, use the SHIELD contact form. The original sources keep their own rights, and the link on each record leads to them.
SHIELD-APS. Frontline Record of Online Harms (FARO). DIRECTORY-URL. Accessed [date]. To cite a particular selection, use the web address shown after you set the filters.
When you rely on the facts of an incident, cite the original source it links to. When you rely on the classification, the patterns or the country report, cite FARO. Please describe the records as documented incidents and do not present counts or country coverage as how often these harms happen. A country with few records may simply have little published about it.
If a record is wrong, a link no longer works, or you are described in a record and want it changed or removed, use the SHIELD contact form and include the title of the record. We review each request and update or remove the record where the request is justified.
Know of a documented incident that belongs here? Send it through the incident form. A public source, such as a news report, a court or regulator decision, or a research publication, helps us verify it quickly. Submissions without a public source are kept anonymous and are not tied to named products or companies. Please leave out the names of children and of anyone who has not agreed to be named. Submissions are reviewed before anything is published, and sending one does not guarantee a record.
