The National Privacy Commission (NPC) has warned that using the face or likeness of an identifiable person to create, post or share AI-generated images and videos without a lawful basis may constitute unauthorized processing of personal data and expose those responsible to criminal, civil and administrative liability.

In an Aug. 11 public notice, the NPC said a person’s face and likeness are personal information under Republic Act No. 10173, or the Data Privacy Act of 2012, while photographs and videos may, in certain instances, constitute biometric information that directly identifies an individual.

According to the Commission, using AI tools to generate images or videos from a real person’s face or likeness, as well as posting or sharing the resulting content, constitutes processing of personal data. 

The NPC said such processing must have a legitimate purpose and satisfy one of the criteria for lawful processing under the Data Privacy Act, which may include consent or other legal bases depending on the circumstances.

“[T]he use of a person’s face and likeness to create synthetic media without any lawful basis may amount to unauthorized processing under Section 25 of the [Data Privacy Act],” the NPC said.

Depending on the extent of the processing, including the posting and sharing of AI-generated media, the NPC said such acts may also violate other penal provisions of the data privacy law and result in criminal penalties and possible civil and administrative liabilities, without prejudice to remedies available under other laws.

Right to removal

The NPC also emphasized that a fabricated image or video depicting an identifiable person constitutes false personal data.

“A fabricated image or video is false personal data,” the Commission said, referring to AI-generated media depicting a real person doing or saying something the individual never did or said, or being somewhere the person never was.

Under Section 16(e) of the Data Privacy Act, the NPC said an affected person may demand the blocking, removal or destruction of personal data upon substantial proof that it is false and may enforce that right by filing a complaint with the Commission.

Free speech, journalism and artistic uses

The Commission acknowledged that satire, parody, commentary and reporting on matters of public interest may be protected by the constitutional rights to freedom of speech, expression and the press, while the Data Privacy Act does not apply to the processing of personal data for journalistic, artistic or literary purposes. However, it said these protections apply only to the minimum extent suitable and necessary to achieve those purposes.

Whether AI-generated media depicting a person’s face or likeness falls within these purposes depends on the circumstances, the NPC said, including whether the content is presented as real, whether its synthetic nature is disclosed and whether using the person’s actual photorealistic likeness is necessary for the purpose.

The NPC stressed that the same considerations apply to AI-generated media depicting public officials, who remain data subjects under the Data Privacy Act. It said their privacy rights should be weighed against the right to information on matters of public concern, but noted that fabricated depictions do not represent their actual conduct in office.

“A fabricated image or video depicts no actual conduct and conveys no information about the discharge of any official function,” the NPC said.

Meanwhile, the NPC said family members of public officials who do not themselves hold public office are private individuals entitled to the full protection of the Data Privacy Act, with complaints involving the likenesses of minors to be treated with “utmost priority.”

Complaints and enforcement

The NPC said a person whose likeness has been misused in AI-generated media may demand its removal from the person or entity that posted or circulated it and may file a complaint with the Commission.

It added that the Commission may investigate the matter based on a complaint or on its own initiative and, when warranted, issue compliance or cease-and-desist orders while the investigation is pending.

The NPC further stated that online platforms are expected to provide accessible mechanisms for reporting such content and promptly remove it in response to lawful demands by affected persons, subject to applicable law and their policies.

Follow Tan Briones & Associates on LinkedIn for more legal updates and law-related articles.