Authored By: Iffah Mariam
UNIVERSITY OF GREATER MANCHESTER - RAK
Introduction
Artificial Intelligence (AI) has revolutionised the digital content creation space, they have enabled the production of highly realistic fake media knows as deepfakes. Its created using deep learning algorithms, deepfakes can manipulate images, audios and videos which very convincingly depict individuals saying or doing things that never happened or that they would never do. Although this is used legitimately in industries like entertainment, education and filmmaking it has been recently rapidly misused and have generated significant legal and ethical concerns. Deepfakes have been used to facilitate identity theft, financial fraud, political misinformation, reputation harm and creation of non-consensual intimate imagery which raises serious questions about whether the existing legal frameworks are capable of addressing these harms [1].
The United Kingdom currently does not have a statue regulating deepfakes. Victims must rely on a combination of legal remedies from areas like defamation, privacy, data protection, copyright, harassment and criminal law. [2]This article argues that although these legal frameworks provide partial protection against the harms caused by deepfakes. In particular the existing framework struggles to respond effectively to non-consensual intimate deepfakes and AI enabled impersonations. To support this argument the article first is going to examine the current legal framework governing deepfakes in the UK, analysing its principal shortcomings and considering the need for a framework balancing individual rights with freedom of expression.
Legal Framework Governing Deepfakes in the United Kingdom
The United Kingdom does not regulate deepfakes through a single dedicated statue as of now. Instead, legal protection is derived from a combination of existing legislation and common law principles addressing specific harms that arise from AI-generated media. These laws provide remedies, but they were enacted before the emergence of deepfakes and only regulate the content indirectly. This often requires victims to rely on multiple legal actions depending on the nature of the harm suffered.[3]
One of the main sources of protection is the Data Protection Act 2018 [4]which operates with the UK General Data Protection Regulation[5]. Deepfakes involve the unauthorised processing of personal data which includes a person’s facial image, voice or other identifiers. Affected individuals may seek remedies through the data protection framework. However, these provisions regulate the processing of personal data rather than the creation or disturbing of fake media itself which limits the effectiveness in addressing the harms associated with deepfakes.
Copyright law also provides protection under the Copyright, Designs and Patents Act 1988 [6]where copyrighted photographs, videos or recordings that are reproduced without authorisation during the creation of deepfakes. Victims experiencing persistent online abuse may rely on the Protection from Harassment Act 1997 [7]if it amounts to a course of harassment. Reputational damage caused by false synthetic media may give rise to civil claims under the law of defamation provided the claimant can establish that the publication caused is likely to cause serious harm to the reputation under the Defamation Act 2013 [8].
Recently the Parliament enacted the Online Safety Act 2023 [9]to strengthen online regulation by imposing duties on digital platforms to address illegal and harmful content. The Act represents an important development in online safety, but it does not establish a comprehensive legal framework governing deepfakes. It addresses harmful online content more generally leaving many AI issues unresolved. Therefore, the current legal framework remains dispersed across multiple areas of law confirming the articles argument that existing protections are reactive rather than purpose built for the unique challenges posed by the deepfake technology.
Key Case law and Critical Analysis
Although the Uk courts have not considered a case specifically involving deepfakes existing case law on privacy and data protection provides guidance for addressing some harms caused by AI content. These decisions also demonstrate that current legal principles were developed before the emergence of deepfake technology and therefore provide only limited protection.
In Campbell v MGN ltd, the House of lords recognized that individuals have a responsible expectation of privacy where the publication of personal information unjustifiably interfered with their private lives [10]. Also, in Douglas v Hello ltd confirmed that the unauthorised publication of private photographs could constitute a misuse of private information [11]. These cases show that victims of deepfakes may rely on privacy law where fabricated content intrudes upon their private lives. However, such remedies are largely reactive becoming available only after the AI material has already been published.
Similarly in Lloyd v Google LC the Supreme Court clarified the scope of compensation for unlawful processing of personal data under the data protection law. [12] While this decision strengthens personal data protection it does not directly address the broader harms caused by Ai generated deception, such as reputational damage, political misinformation or identity manipulation.
These decisions support this articles argument that the UK’s legal framework remains fragmented. Victims must rely on multiple legal claims including privacy, defamation, copyright or data protection depending on the circumstances of each case. Although recent legislation including the Online Safety Act 2023 represents progress in regulating harmful online content a comprehensive legal framework specifically addressing deepfakes is still absent. Consequently, targeted legislative reform is necessary to provide clearer protection against the unique risks posed by AI generated synthetic media. [13]
Conclusion
Deepfake technology poses significant legal challenges that extend beyond the scope of the UK legal framework as it is presently constituted. While victims have some potential avenues for redress through privacy, data protection, copyright, defamation, harassment and online safety laws, these protections are piecemeal and largely reactive. The existing legal framework and case law demonstrate that it was not designed to address the specific risks of AI-generated synthetic media.
In this article we have argued that the lack of a dedicated legal framework creates uncertainty for victims and constrains the law’s ability to respond effectively to harms such as non-consensual intimate deepfakes, identity misuse and digital misinformation. Recent legislation such as the Online Safety Act 2023 is welcome but does not address deepfake technology comprehensively.
It is therefore submitted that the United Kingdom should enact targeted legislation to deal with malicious deepfakes. Such legislation should clearly define unlawful deepfake content, create effective civil and criminal remedies and impose appropriate duties on digital platforms to detect and remove harmful material. A dedicated legal framework would also bring more certainty to victims and at the same time ensure that technological innovation takes place in parallel with appropriate legal safeguards and the protection of fundamental rights.
Reference(S):
Primary Sources
Legislation
Copyright, Designs and Patents Act 1988.
Data Protection Act 2018.
Defamation Act 2013.
Online Safety Act 2023.
Protection from Harassment Act 1997.
UK General Data Protection Regulation (UK GDPR).
Cases
Campbell v MGN Ltd [2004] UKHL 22, [2004] 2 AC 457.
Douglas v Hello! Ltd [2007] UKHL 21, [2008] 1 AC 1.
Lloyd v Google LLC [2021] UKSC 50, [2022] AC 1217.
Secondary Sources
Books
Danielle Keats Citron, The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age (W W Norton 2022).
Paul Bernal, What Do We Know and What Should We Do About Internet Privacy? (SAGE 2020).
Journal Articles
Robert Chesney and Danielle Keats Citron, ‘Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security’ (2019) 107 California Law Review 1753.
Bobby Chesney and Danielle Keats Citron, ‘Deep Fakes and the New Disinformation War’ (2018) Foreign Affairs 147.
Reports and Government Publications
Department for Science, Innovation and Technology, A Pro-Innovation Approach to AI Regulation (White Paper, 2023).
House of Commons Library, Artificial Intelligence: Deepfakes (Research Briefing CBP-9965, 2024).
Law Commission of England and Wales, Modernising Communications Offences (Law Com No 399, 2021).
[1] House of Commons Library, Artificial Intelligence: Deepfakes (Research Briefing CBP-9965, 2024); Department for Science, Innovation and Technology, A Pro-Innovation Approach to AI Regulation (White Paper, 2023).
[2] Law Commission of England and Wales, Modernising Communications Offences (Law Com No 399, 2021); Online Safety Act 2023.
[3] House of Commons Library, Artificial Intelligence: Deepfakes (Research Briefing CBP-9965, 2024).
[4] Data Protection Act 2018; UK General Data Protection Regulation arts 5–6.
[5] UK General Data Protection Regulation, retained Regulation (EU) 2016/679.
[6] Copyright, Designs and Patents Act 1988.
[7] Protection from Harassment Act 1997.
[8] Defamation Act 2013, s 1.
[9] Online Safety Act 2023, s 9.
[10] Campbell v MGN Ltd [2004] UKHL 22, [2004] 2 AC 457.
[11] Douglas v Hello! Ltd [2007] UKHL 21, [2008] 1 AC 1.
[12] Lloyd v Google LLC [2021] UKSC 50, [2022] AC 1217.
[13] Danielle Keats Citron, The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age (W W Norton 2022); Robert Chesney and Danielle Keats Citron, ‘Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security’ (2019) 107 California Law Review 1753.
