A creative response to Generative AI
Former Vice President and Principal Analyst
Constellation Research
Steve Wilson is former VP and Principal Analyst at Constellation Research, leading the business theme Digital Safety and Privacy. His coverage includes digital identity, data protection, data privacy, cryptography, and trust. His advisory services to CIOs, CISOs, CPOs and IT architects include identity product strategy, security practice benchmarking, Privacy by Design (PbD), privacy engineering and Privacy [or Data Protection] Impact Assessments (PIA, DPIA).
Coverage Areas:
- Identity management, frameworks & governance- Digital identity technologies- Privacy by Design
- Big Data; “Big Privacy”- Identity & privacy innovation
Previous experience:
Wilson has worked in ICT innovation, research, development and analysis for over 25 years. With double…...
Read more
With Generative AI being used to imitate celebrities and authors, the question arises, is your likeness a form of intellectual property (IP)? Can you copyright your face or your voice?
These questions are on the bleeding edge of IP law and may take years to resolve. But there may be a simpler way to legally protect appearances. On my reading of technology-neutral data protection law — widespread internationally and now rolling out across the USA — generating likenesses of people without their permission could be a privacy breach.
Let’s start with the generally accepted definition of personal data as any data that may reasonably be related to an identified or identifiable natural person.
Personal data (sometimes called personal information) is treated in much the same way by the California Privacy Rights Act (CPRA), Europe’s General Data Protection Regulation (GDPR), Australia’s Privacy Act, and the new draft American Privacy Rights Act (APRA).
These sorts of privacy laws place limits on how personal data is collected, used and disclosed. If personal data is collected without a good reason, or in excess of what’s reasonable for the purpose, or without the knowledge of the individual concerned, then privacy law may be breached.
Technology neutrality in privacy law means it does not matter how personal data is collected. In plain language, if personal data comes to be in a storage system, then it has been collected. Collection may be done directly via forms, questionnaires and measurements, or indirectly by way of acquisitions, analytics and algorithms.
To help stakeholders deal with the rise of analytics and Big Data, the Australian privacy regulator has developed additional guidance about indirect collection of personal data:
“The concept of ‘collects’ applies broadly, and includes gathering, acquiring or obtaining personal information from any source and by any means. This includes collection by ‘creation’ which may occur when information is created with reference to, or generated from, other information” (emphasis added; ref: Guide to Data Analytics and the Australian Privacy Principles, Office of the Australian Information Commissioner, 2019).
How should privacy law treat facial images and voice recordings?
What are images and voice recordings? Simply, these are data (‘ones and zeros’) in a file which represent optical or acoustic samples that can be converted back to analog to be viewed or heard by people.
Now consider a piece of digital text. That too is a file of ones and zeros, this time representing coded characters, which can be converted by a printer to be human readable. If the words thus formed are identifiable as relating to a natural person, then the file constitutes personal data.
So if any data file can be rendered as an image or sound which is identifiable as relating to a natural person (that is, the output looks like someone) then the file is personal data about that person.
Under technology neutral privacy law, it doesn’t matter how the image or sound is created. If data generated by an algorithm is identifiable as relating to a natural person (for example, by resembling that person) then that data is personal data, which the Australian privacy commissioner would say has been collected by creation. The same sort of interpretation would be available under any similar technology-neutral data protection statute.
If a Generative AI model makes a likeness of a real-life individual Alice, then we can say the model has collected personal information about Alice.
I am not a lawyer but this seems to me to be easy enough to test in a ‘digital line up’. If a face or voice is presented to a sample of people, and an agreed percentage of them say it reminds them of Alice, then the evidence would suggest that personal data of Alice has been collected.
In any jurisdiction with technology-neutral privacy law, that might be a breach of Alice's rights.
Digital Safety, Privacy & Cybersecurity
Data to Decisions
Innovation & Product-led Growth
Future of Work
Tech Optimization
Next-Generation Customer Experience
Distillation Aftershots
ML
Machine Learning
LLMs
Agentic AI
Generative AI
Robotics
AI
Analytics
Automation
Quantum Computing
Cloud
Digital Transformation
Disruptive Technology
Enterprise IT
Enterprise Acceleration
Enterprise Software
Next Gen Apps
IoT
Blockchain
Leadership
VR
Security
Zero Trust
business
Marketing
SaaS
PaaS
IaaS
CRM
ERP
finance
Healthcare
Customer Service
Content Management
Collaboration
Chief Executive Officer
Chief Information Officer
Chief Technology Officer
Chief AI Officer
Chief Data Officer
Chief Analytics Officer
Chief Information Security Officer
Chief Product Officer
Chief Privacy Officer