Deepfake Bills in Denmark and the Netherlands: Right idea, wrong legal framework.

Het artikel van P. Bernt Hugenholtz bespreekt hoe de wereldwijde opkomst van deepfakes leidt tot nieuwe wetgevingsinitiatieven, zoals het Amerikaanse TAKE IT DOWN Act en NO FAKES Act, artikel 50(4) AI Act in de EU, en plannen in Denemarken en Nederland. Hoewel de zorgen over reputatieschade, misleiding en democratische ondermijning terecht zijn, kiezen de Deense en Nederlandse voorstellen opvallend genoeg voor een intellectueel-eigendomsbenadering. Beide willen iedere natuurlijke persoon een nieuw naburig recht geven om deepfakes van zijn of haar persona te controleren en te gelde te maken. Hugenholtz bekritiseert deze keuze: zij bevordert commercialisering in plaats van beperking, terwijl bestaande privacy-, media- en strafrechtelijke kaders al bescherming bieden. Volgens hem ligt het echte probleem niet in een gebrek aan rechten, maar in de moeizame handhaving tegenover vaak anonieme en buitenlandse daders.

Is granting every person a new IP right the best way to deal with deepfakes? I don’t think so. Although to a hammer everything may look like a nail, IP law is only one of many instruments in the lawmaker’s toolkit. If concerns over privacy and reputation are the main reasons for regulating deepfakes, any new rules should be grounded in the law of privacy. If preserving trust in the media or safeguarding democracy are the dominant concerns, deepfakes ought to be addressed in media regulation or election laws. The Danish and Dutch bills address and alleviate none of these concerns. To the contrary, they embrace and encourage deepfakes as a new and potentially lucrative mode of exploiting a person’s most intimate possession, his or her digital persona.

Leaving aside these fundamental objections, both bills raise a more pragmatic question: is existing law really inadequate? As said, there may be good reasons to strengthen the protection of performing artists against deepfakes. But leaving neighbouring rights aside, existing law in civil jurisdictions already offers victims of unwanted deepfakes a broad choice of legal remedies, including image rights, the GDPR, tort law, unfair competition law, unlawful advertising, and possibly even trademark protection. In addition, deepfakes are punishable as criminal acts such as fraud, identity theft and ‘revenge porn’.

In 2022, a study commissioned by the Dutch Ministry of Justice concluded that existing Dutch law already offers sufficient rights and sanctions to prohibit deepfakes. The real problem, say the authors of the study, is enforcement. A deepfaked person may have all the civil rights and remedies he or she needs, effectively enforcing these rights against anonymous perpetrators operating from unknown territories is another matter altogether – a sobering lesson the internet teaches us again and again.