Deepfakes, Detection and Data Protection

Dr. Michael Abrahams, in his article in the Jamaica Gleaner "AI will be the death of us" published on July 2nd, 2024, highlights a critical issue: the misuse of deepfake technology. Dr. Abrahams described how he recently was a victim of impersonation via a deepfake video ad. How can we mitigate against the growing threat of AI-driven identity theft, misinformation, and the violation of personal privacy? Truth be told, it can happen to any one of us.?

Addressing Deepfakes?

Deepfakes, by their nature, can be highly convincing and are easily disseminated across social media platforms, leading to potential reputational damage, financial loss, and erosion of public trust.?

The measures required to address these challenges include legal frameworks to penalize unauthorized use of personal data, advanced AI detection tools to identify deepfakes, and public awareness campaigns to educate individuals on the risks and safeguards associated with digital content.

The Role of the Jamaican Data Protection Act

The Jamaican Data Protection Act (JDPA), provides the legal framework to address challenges posed by deepfake technology. Here’s how the JDPA could protect data subjects like Dr. Abrahams and ensure accountability:

Consent and Authorization:

The JDPA mandates that personal data, including images and voice recordings, must be processed with the data subject's explicit consent. Deepfake creators who use someone's likeness without consent are in clear violation of this provision. Victims could potentially file complaints with the Information Commissioner’s Office, leading to investigations and potential legal actions against perpetrators. It’s also important to note that under the Cybercrimes act, the guilty party may also be guilty of the offence of Computer Related Fraud or Forgery.

Data Subject Rights:

Under the JDPA, individuals have the right to access, rectify, and erase their personal data. If a deepfake video falsely represents a person, they can request the removal of such content from platforms and demand corrections. The act empowers individuals to take control of their digital identities and seek redress for misuse.

Enforcement and Penalties:

The JDPA outlines stringent penalties for unauthorized data processing. Organizations or individuals found guilty of creating or distributing deepfakes without consent could face substantial fines and legal repercussions.?

Meta’s Liability under the Jamaican Data Protection Act

Section 69 of the JDPA states that an individual who suffers damage or distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage or distress.?

Given that the perpetrators in this case used Facebook and Instagram Ads, the question arises whether Meta (the parent company of Facebook and Instagram) would be liable under the JDPA. While the primary responsibility lies with the creators of the deepfake content, Meta could also bear some accountability under the following conditions:

Platform Responsibility:

If Meta is found to have failed to implement adequate measures to prevent the dissemination of deepfake content, they could be held partially responsible.?

Data Controller Obligations:

As a data controller processing the data of Jamaican citizens, Meta has obligations under the JDPA to protect the personal data of Jamaicans on their platform. If the platform is used to process data without proper consent, Meta could be implicated for not adhering to the legal standards set by the JDPA.

Removal of Content:

The JDPA empowers data subjects to demand the removal of unauthorized content. The platform (Meta) would be obligated to remove the deepfake video and take steps to prevent further dissemination. Failure to act promptly on such requests could result in liability.

Ways to Detect Deepfake Videos

Detecting deepfake videos requires a combination of technological tools and user vigilance. Here are some effective methods:

AI Detection Tools:

Advanced AI algorithms can analyze videos for inconsistencies, such as unnatural facial movements, irregular blinking, and mismatched lighting or shadows. Tools like Deepware, Sensity, Microsoft’s Video Authenticator, and others are designed to detect deepfakes.

Digital Watermarking:

Authentic videos often include digital watermarks or signatures that can be verified. Lack of such identifiers in a video can be a red flag.

Human Analysis:

Training individuals to recognize subtle signs of deepfakes, such as inconsistencies in lip-syncing, unnatural eye movements, or audio-visual mismatch, can complement technological detection methods.

Ways to Prevent Being a Victim of Deepfake Cloning

Preventing deepfake cloning involves proactive measures to protect one's digital identity:

Limit Sharing Personal Media:

Be cautious about sharing high-resolution images and videos of yourself online. The more data available, the easier it is for malicious actors to create deepfakes.

Use Privacy Settings:

Adjust privacy settings on social media platforms to restrict who can view and download your photos and videos.

Monitor Your Digital Presence:

Regularly search for your name and images online to detect any unauthorized use of your likeness. Set up alerts for any new content that might be using your identity.

Educate Yourself and Others:

Stay informed about the latest developments in deepfake technology and educate your network on how to recognize and report suspicious content.

The Jamaican Data Protection Act provides a framework to protect individuals’ identities, ensure accountability, and mitigate the risks associated with AI technologies. By upholding these principles, we can harness the power of AI for good, creating a safer and more innovative digital landscape.

As we navigate this complex technological frontier, it is crucial for policymakers, technologists, and the public to collaborate in promoting responsible AI use and safeguarding personal data. Only through collective effort can we ensure that technology serves humanity, upholds our rights, and fosters a future where innovation and privacy coexist harmoniously.

---

Jeehan Miller holds an MBA in Information Technology Management and is Certified in Cyber Security, a Certified Cyber Risk Specialist, and CEO of Global Business Vault Ltd.

She can be contacted at [email protected]