NPC warns AI deepfakes using real people may violate Data Privacy Act
Text size
The National Privacy Commission (NPC) has warned that using artificial intelligence tools to create images or videos using a real person's face or likeness, as well as posting or sharing the resulting content, may violate the Data Privacy Act of 2012.
The NPC issued the warning amid the increasing circulation of AI-generated synthetic media depicting real and identifiable individuals.
According to the commission, using a person's face and likeness to generate such content constitutes the processing of personal data and must therefore have a legitimate purpose and lawful basis under Republic Act 10173.
“In fact, in certain instances, photographic and videographic media may also constitute biometric information that directly identifies an individual. Like any processing of personal data, these acts must have a legitimate purpose and must conform with any of the criteria for lawful processing found under the DPA,” the NPC said.
While consent is the most recognizable basis for processing personal information, the commission noted that the law provides other lawful bases that may apply depending on the circumstances.
The NPC warned that using someone's face or likeness to create synthetic media without a lawful basis may constitute unauthorized processing under Section 25 of the DPA.
Posting or sharing the AI-generated material could also violate other penal provisions of the law, depending on the extent of the processing.
Violations may carry criminal penalties as well as civil and administrative liabilities, without prejudice to remedies available under other laws.
The NPC also stressed that fabricated images and videos involving real people may constitute false personal data.
“AI-generated media that depicts a real person doing something the person never did, saying something the person never said, or being somewhere the person never was, is false information about that person,” the commission said.
Under Section 16(e) of the DPA, individuals may demand the blocking, removal or destruction of their personal data upon substantial proof that the information is false. The right may also be enforced by filing a complaint with the NPC.
A person whose likeness has been misused in AI-generated content may demand its removal from the person or entity that posted or circulated it and may lodge a complaint with the commission.
The NPC may investigate based on a complaint or on its own initiative and issue compliance or cease-and-desist orders when warranted.
The commission, however, recognized protections for satire, parody, commentary, journalism and other forms of expression.
“While the Commission recognizes that satire, parody, commentary, and reporting on matters of public interest may fall under the constitutional right to freedom of speech, of expression, or of the press, and that the DPA does not apply to the processing of personal data for journalistic, artistic, or literary purposes, these protections only attach to the purposes behind the use of a person's likeness to the minimum extent suitable and necessary to achieve them,” the NPC said.
The commission stressed that such protections are tied to the purpose for which a person's likeness is used and only to the extent necessary to accomplish that purpose.
