The Italian authority sanctioned an audiovisual production company for the use of deepfake technology for satirical purposes, judging that the realism of the videos and the insufficiency of warnings violated the principles of fairness and transparency, as well as the obligation of data protection by design.

Facts and context

The Italian data protection authority (GPDP) today published a sanction decision against the company R.T.I. Spa (including the issuance of a warning) for breaches related to the use of deepfake technology for satirical purposes.

This case originated from a complaint by a well-known journalist concerning the manipulation of his image and voice in several television reports, where artificial intelligence systems were used to attribute statements to him that he had never made.

Reasons for the decision

• Obligation of fair, lawful and transparent processing (Article 5 of the GDPR): The authority considered that, even for satirical purposes, processing must respect the dignity of individuals and the principles of the GDPR. In this case, the realism of the images, the low perceptibility of the alteration, and the plausibility of the statements were likely to mislead the public into believing the authenticity of the content. The warnings about the artificial nature of the videos were deemed insufficient, as they were neither clear enough nor obvious and understandable to all viewers and social media users, thus failing the requirements of fairness and transparency.
• Obligation of data protection by design and by default (Article 25 of the GDPR): The authority concluded that the company had not implemented appropriate technical and organizational measures to ensure respect for the rights of the data subject from the design stage of the processing. By producing and broadcasting manipulated content without providing sufficient safeguards to prevent misleading the public, the company failed in its obligation to integrate data protection principles upstream of its activities.

Decision of the authority

Consequently, the authority issued a warning against R.T.I. Spa.

Furthermore, the authority ordered the prohibition of any further use of the journalist's data under the contested conditions, while allowing their retention for possible judicial purposes.

Lessons learned

This decision reminds that:

• The satirical purpose of processing does not exempt it from compliance with the fundamental principles of the GDPR, notably fairness, transparency, and respect for the dignity of the individual.
• The use of deepfake technologies creating highly realistic content requires increased vigilance, as the risk of misleading the public is a key factor in assessing the breach of the fairness principle.
• A simple warning about the artificial nature of content may be deemed insufficient if it is not sufficiently clear, visible, and understandable by the entire target audience, including on social media platforms.
• The obligation of data protection by design applies to content creation processes, requiring the integration of safeguards for individuals' rights even before dissemination, such as truly effective warning mechanisms.