The Philippines’ National Privacy Commission has warned that creating or distributing AI-generated images and videos based on a real person’s face may violate the country’s Data Privacy Act when there is no lawful basis for the processing.
The regulator said a person’s face and likeness qualify as personal information. Photographic or video material may also constitute biometric information when it directly identifies an individual. Feeding that material into an AI tool, then posting or sharing the output, counts as personal-data processing regardless of the purpose of the resulting media.
Consent is one recognized basis for lawful processing, but the law provides others that may apply depending on the circumstances. Without a valid basis, the commission said the activity may amount to unauthorized processing under Section 25 and could bring criminal penalties as well as civil or administrative liability.
The notice also treats fabricated images and videos as false personal data when they depict someone doing or saying something that never occurred. Affected people may demand that the content be blocked, removed or destroyed, provided they can offer substantial proof that it is false.
The warning is not an outright ban on synthetic media involving identifiable people. The commission recognized protections for journalism, art, literature, satire, parody, commentary and reporting on matters of public interest. Whether an exemption applies depends on factors such as disclosure that the content is synthetic, the way it is presented and whether using a photorealistic likeness is necessary for the stated purpose.
Public officials remain protected as data subjects, although their privacy interests must be weighed against access to information on public matters. The commission said family members who do not hold office are private individuals and that complaints involving minors will receive priority.
People whose likenesses are misused can seek removal from the person or organization that circulated the material and file a complaint with the commission. The regulator may investigate, issue compliance or cease-and-desist orders, and notify platforms or government agencies. It also expects online platforms to provide accessible reporting and removal mechanisms.
The notice broadens the Philippines’ active scrutiny of identity technologies. The commission has separately challenged Worldcoin’s biometric data collection, while regulators internationally are developing responses to deepfakes and synthetic impersonation.
Sources: National Privacy Commission, PhilSTAR Life
–
By Ji-seo Kim
