Spanish Data Protection Agency Issues Fine for Deepfake Dissemination
The Spanish Data Protection Agency (AEPD) has imposed a fine of €2,000, reduced to €1,200 for timely payment, on an individual responsible for circulating deepfake images featuring naked bodies. This technique utilizes artificial intelligence (AI) to superimpose the victim's face onto the body of another person who is nude.
Details Surrounding the Case Remain Confidential
Although the resolution was made public on October 27, specific details about the case, including the identities and genders of the victims, remain confidential. However, references within the resolution suggest that the victims may include minors. Sources indicate that this case aligns with the September 2023 scandal involving the creation and dissemination of deepfake nude images of at least 20 girls from Almendralejo, Badajoz. Given the scale of this incident, the AEPD is expected to announce additional fines related to similar cases in the near future.
Legal Framework and Implications
The fine was issued for the unauthorized dissemination of personal data, including photographs, implicating the rights of the individuals involved. The agency specifically noted that the processing of personal data belonging to a third party was unlawful, potentially connecting it to the Almendralejo situation.
This sanction operates alongside a criminal investigation that was initiated due to the distribution of pornographic content involving minors. As a result of this criminal procedure, 15 minors received a year of supervised release for their involvement in the manipulation of the images.
Significance of the AEPD's Fine
This is the first sanction from a European Union data protection authority concerning the dissemination of deepfake content. Experts have remarked that the penalty of €2,000 appears disproportionately low given the severity of the damage caused. Previous fines imposed by the agency for similar infractions have reached up to €60,000.
Jorge García Herrero, a lawyer and data protection delegate, noted, “Very few risks related to AI cause as much social alarm as the creation of deepfakes involving non-consensual sexual relations with minors. While a €1 million fine may not solve the problem, imposing a significant and exemplary penalty should be a priority.”
Timeline of Events
According to the records, the then-director of the AEPD, Mar España, initiated preliminary investigation actions on September 20, 2023, shortly after the nature of the case became public. Subsequently, on October 2, an individual lodged a complaint that triggered the fine.
