Frauds committed using deepfakes have not yet a shaped and refined jurisprudence in the Brazilian courts. In recent months, the issue of alterations to videos and photos with the help of artificial intelligence (AI) has gained significant prominence in the media. However, due to the technology allowing these modifications being relatively recent, the legal aspects related to the subject are still gradually being understood by the courts.
Despite the absence of specific jurisprudence, there are some regulations in the national legal system that can be used as a basis. In the Federal Constitution, dated 1988, the right to privacy and image is guaranteed. In article 5, paragraph X, it is written that ‘the intimacy, private life, honor, and image of individuals are inviolable, with the right to compensation for material or moral damage resulting from their violation.’
The Brazilian Civil Code also deals with related themes, providing a basis for the protection of personality rights related to honor and image. Article 11 establishes that the law guarantees protection of private life, honor, and image. Article 20 prohibits the exposure or use of someone’s image without permission, if the improper use affects their honor, good reputation, respect, or is intended for commercial purposes.
In the Penal Code, crimes of calumny, defamation, and insult are typified, which also affect people’s honor. Calumny is defined as the false attribution of a crime to someone. Defamation is identified as the attribution of an offensive fact to someone’s reputation. Insult is classified as a direct offense to someone’s dignity or decorum.
Another that can be applied is the General Data Protection Law (LGPD), which was sanctioned in 2018 and came into effect in 2020. It does not specifically address deepfakes, but provides a legal framework that can be used to protect personal data in contexts involving AI.
In its article 5, the LGPD defines what personal data is. In article 7, it states that the processing of personal data generally requires the consent of the data subject. In 18, it guarantees rights of access and rectification. In 46, it requires entities processing personal data to adopt security measures to protect them. Between articles 52 and 54, responsibilities and penalties related to misuse and unauthorized access are addressed.
Thus, in a practical scenario, cases of deepfake can be reported to the National Data Protection Authority (ANPD), requiring the removal of the content. In severe cases, compensation for damages can be sought through legal action, both by individuals and legal entities.
