Deepfakes & Data Protection

deepfakes Data Protection

What is a deepfake?

A deepfake is a video or audio recording that is edited to create a fake clip of an individual saying or doing something which never happened.

A deepfake can be used for a number of sinister reasons and, in some cases, can be used to create fake pornographic material of celebrities or other individuals.

The use of deepfakes to create fake pornographic content for non-consenting individuals is on the rise. The criminal offence of revenge porn, as set out in Sections 33 – 35 of the Criminal Justice and Courts Act 2015, however, does not cover this type of content.

Given that deepfakes are a relatively new phenomenon, there is currently no specific legislation that deals with this in the UK. There are, however, a number of civil actions that may be available to a victim of deepfakes.

Misuse of Private Information

The statutory framework for the law on the misuse of private information derives from the Human Rights Act 1998 and the European Convention of Human Rights (ECHR).

Article 8 of ECHR protects a person’s right to “respect for his private and family life, his home and his correspondence”. In essence, this protects a person’s “private life” from unwanted intrusion.

Arguably, by creating a deepfake of an individual you are infringing on the person’s private life in contravention of Article 8.

In terms of remedies, an individual can seek damages together with a potential injunction to restrain the misuse. The damages for misuse of private information tend to be relatively modest except in high-profile cases involving celebrities.


Section 1 of the Protection from Harassment Act 1997 sets out that a person must not pursue a course of conduct that amounts to harassment of another and which he/she knows or ought to know amounts to harassment of the other.

In accordance with Section 7 of the Harassment Act 1997, harassment is defined as causing a person alarm or distress. You must have also experienced at least two acts of harassment to pursue such a claim.

In the case of deepfakes, if someone created fake pornographic content of you then this is very likely to be incredibly distressing. Provided that a deepfake creator has made at least two deepfakes of one particular individual, the individual would have a potential course of action under harassment.

Deepfakes and data protection laws

The information contained within a deepfake could be considered personal data of the victim under Article 4(1) of the UK GDPR as it “relates to an identified or identifiable natural person”.

It then must be established whether the data was being processed in line with the definition within the UK GDPR. Processing is defined as “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaption or alteration” [emphasis added].

By creating a deepfake the creator is altering the image/video of the individual and putting it onto an entirely different video or image and therefore would be classed as processing in accordance with the UK GDPR.

The creator of the deepfake would therefore be bound by the UK GDPR and the Data Protection Act 2018 (DPA 2018) and the data subject could enforce their right under the UK GDPR and/or DPA 2018. Such rights may include the right to rectification and the right to erasure.

deepfakes Data ProtectionHow can we help

Ruby Ashby is a Senior Associate in our expert Dispute Resolution team, specialising in data breach claims, inheritance and Trust disputes and defamation claims.

If you require any advice in relation to the subjects discussed in this article, please do not hesitate to contact Ruby or another member of the team in Derby, Leicester or Nottingham on 0800 024 1976 or via our online enquiry form.

Contact us

Contact us today

We're here to help.

Call us on 0800 024 1976

Main Contact Form

Used on contact page

  • Email us