The National Privacy Commission (NPC) on Tuesday noticed an “increasing circulation” of synthetic media, that included images and videos that were generated through artificial intelligence (AI) that showed real and identifiable people.
In a statement, the commission reminded the public that a “person’s face and likeness are personal information under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA)”.
“In fact, in certain instances, photographic and videographic media may also constitute biometric information that directly identifies an individual. Using AI tools to generate an image or video from a real person's face and likeness and posting or sharing the resulting image and/or video, are forms of processing of personal data, whatever the nature or purpose of the resulting media,” the NPC said.
It reminded further that these acts must have a “legitimate purpose and must conform with any of the criteria for lawful processing found under the DPA”.
“While consent of the person depicted is the most recognizable criterion, the DPA provides other bases, which may be applicable depending on the circumstances of each case. Nevertheless, the use of a person’s face and likeness to create synthetic media without any lawful basis may amount to unauthorized processing under Section 25 of the DPA, and, depending on the extent of such processing, including the posting and sharing of such AI-generated media, may also constitute violations of the DPA’s other penal provisions. These violations carry criminal penalties and possible civil and administrative liabilities without prejudice to remedies found in other laws,” the commission stated.
“The Commission emphasizes that a fabricated image or video is false personal data. AI-generated media that depicts a real person doing something the person never did, saying something the person never said, or being somewhere the person never was, is false information about that person. Under Section 16(e) of the DPA, a data subject may demand the blocking, removal, or destruction of personal data upon substantial proof that the data is false, and this right may be enforced through a complaint before the Commission,” it added.
The NPC also said that while they recognize the likes of satire, parody, commentary, and reporting on matters of public interest falling under the constitutional right to freedom of speech and expression, protections are only attached “to the purposes behind the use of a person’s likeness to the minimum extent suitable and necessary to achieve them”.
“Whether the use of AI-generated media depicting a person’s face and likeness falls under any of these purposes depends on the circumstances of each instance, including whether the image is presented as real, whether its synthetic character is disclosed, and whether the use of the person’s actual photorealistic likeness is necessary such purpose,” the agency said.
It also warned about the use of AI-generated images of public officials, as they, too, are subjects of the DPA.
“While their right to privacy should be weighed against the right to information on matters of public concern, a fabricated image or video depicts no actual conduct and conveys no information about the discharge of any official function. Family members of public officials who do not themselves hold public office, above all minor children, are private individuals entitled to the full protection of the DPA, and the Commission will treat complaints involving the likenesses of minors with utmost priority,” the NPC said.
“The Commission reminds all persons who create, post, and/or share AI-generated synthetic media to respect the rights and dignity of individuals, and to act promptly and in good faith to remove such content upon lawful demand of the affected persons,” it added.
