Innocent people, including human rights campaigners and a three-year-old girl, have been named on a blacklist of terrorists and criminals used by governments and major banks, it has been reported.

Greenpeace and Human Rights Watch were among the two million supposed “high risk” organisations and individuals on the database, which is compiled by media giant Thomson Reuters.

The watchlist, which also includes people who have been charged and cleared of terror offences, was accidentally leaked on a public internet server in 2014 and discovered by a computer security researcher last year.

Theresa May could change human rights laws in terror fight

It has reportedly been sold to almost every major bank and is designed to help them identify individuals and groups who may be involved in money laundering.

Those named on the list could be at risk of being refused grants, contracts and financial services, according to The Times, which conducted the investigation in collaboration with media partners across Europe.

Privacy International legal officer Tomaso Falchetta told the paper: “The risk of discriminating against individuals, groups, and communities is very high.”

Analysis of the leaked database revealed that a Dutch potato farmer and a minor royal’s three-year-old daughter were on the list, which Thomson Reuters is said to make using public sources including media reports and claims on extremist websites.

Greenpeace was reportedly put on the list after receiving a fine for inadvertently damaging a coral reef, while two former detainees at Guantanamo Bay were included despite being released and exonerated.

A spokesperson for Human Rights Watch said the organisation was “surprised and puzzled” to find itself and director José Miguel Vivanco on the blacklist.

Britain’s privacy watchdog said anybody who suspects their information has been unfairly handled can raise concerns with the Information Commissioner’s Office.

Thomson Reuters doesn’t inform people they have been added to the database, but the firm said it regularly updates it and tells subscribers to confirm the information.