Garante issues warning against generating non-consensual deepfakes

The Provision reiterates that a person’s voice and image constitute personal data and may, in some cases, also be biometric data. Organisations using such data to generate AI deepfakes therefore require a lawful basis under Article 6 EU GDPR and if applicable, a special condition under Article 9(2) GDPR. The Provision notes that individuals must be clearly informed in advance where their voice or image is being used to generate deepfakes and must be made aware of the associated risks.

The Garante reminds AI providers to incorporate data protection by design throughout the development and deployment of their tools to assist controllers and processors to comply with their data protection obligations. The Provision concludes by warning organisations that non-compliance with data protection obligations when using AI to generate content from the voice or images of data subjects will attract enforcement action.

The press release is available here, and the Provision here, both only available in Italian.