The Dutch politician Caroline van der Plas proclaiming the weather forecast, the author Maarten van Rossum dancing to "I'm too sexy" and Prime Minister Mark Rutte telling "the honest story" about the climate crisis. These are a few examples of deepfakes from Dutch soil. Deepfakes are videos and sound fragments - created with the help of AI - in which it seems as if someone is really there. Using deepfakes can be attractive. But what are the legal risks of using a (voice) deepfake without the consent of the person involved?

Using a deepfake is not directly punishable under Dutch criminal law. The articles of law relating to identity fraud (art. 231a and 231b of the Criminal Code) (in Dutch) do not apply to deepfakes. 

However, a deepfake can infringe on the person's portrait right (Art. 21 Dutch Copyright Act) (in Dutch). As soon as someone's face is recognizable, it is a portrait. The person concerned can take action against publication of the deepfake if he has a reasonable interest in doing so. This usually involves weighing his privacy interest against the discloser's freedom of expression. The person concerned may also have a commercial interest against disclosure. This is in the case of persons who are usually paid to do so, for example. Freedom of expression may weigh more heavily if there is obvious parody, for example. Voice ephemera, on the other hand, are not covered by portrait rights (in Dutch).

The data subject can additionally invoke the GDPR. When publishing a (voice) deepfake, personal data are processed. This requires a processing basis, such as the data subject's consent or a more weighty legitimate interest of the deepfake maker. In addition, the data subject must be informed about the deepfake. Personal data may also not simply be used for a purpose other than that for which it was collected. In addition, the data subject may be able to invoke rectification and the right to be forgotten.

Moreover, a deepfake of a well-known person offering a product can be misleading. 

Finally, the upcoming AI regulation introduces the obligation to disclose that a deepfake has been artificially generated. 

Lisa Peek