The German Federal Council (Bundesrat (chamber of the parliament representing the 16 state governments) introduced a draft law aimed at safeguarding personal rights from the misuse of deepfakes under criminal law. According to the Federal Council, the legal frameworks to combat abusive deepfakes are currently inadequate. Current German laws used to address deepfakes were established before the technology existed and included various legal areas like privacy and copyright. This has led to a legal framework that is confusing and incomplete.

Deepfakes can pose considerable risks to individual personal rights and assets, as well as to the democratic decision-making process. They can be used for disinformation purposes, to pursue self-serving economic interests, and to violate personality rights. The use of generative AI to produce and distribute such content has made it easier for offenders to create and share harmful material. To tackle these unique challenges, the draft suggests adding Section 201b to the German Criminal Code, titled "Violation of Personal Rights Through Digital Forgery."

The draft law criminalizes the creation and distribution of deepfakes that infringe on personal rights by using computer technology to produce or alter media content that mimics real-life likenesses, behaviours, or speech. Such actions could lead to a custodial sentence of up to two years or a fine. More severe penalties, including imprisonment of up to five years or substantial fines, are proposed if the altered content is made public or involves highly personal matters. The proposal also allows for the confiscation of image or sound carriers and other technical means used by the perpetrator or participant.

Additionally, the law seeks to protect deceased individuals if the deepfakes seriously violate their right to privacy.

By suggesting the provision, the Federal Council gives operators of social networks and other internet platforms a clear indication of which content is to be regarded as unlawful within the meaning of the Digital Services Act (DSA), which needs to be treated in accordance with its provisions (e.g. notice-and-take-down).

Furthermore, the Federal Council believes that the disclosure obligation provided for in the EU AI Act (Art. 50), in itself is an insufficient instrument to tackle deepfakes that infringe on personal rights. The regulation does not target users employing AI for personal, or non-professional purposes, and those intending to use the content unlawfully are unlikely to be deterred by transparency requirements.

Exceptions

The proposal includes exceptions for actions carried out in the exercise of overriding legitimate interests, such as:

• Art
• Science
• Research
• Teaching
• Reporting on current events
• History

Additional demands by the Federal Council

a) Technological Solutions: The Federal Council urges the Federal Government to support programs that develop and implement technologies for detecting and identifying deepfakes.

b) Evaluation and Adaptation: Regular evaluation of AI-related laws, including those on deepfakes, is desirable. The responsible body should recommend optimising personal rights protection in line with technological advances and reducing bureaucracy.

c) Support for the Economy: The Federal Council recommends establishing a central contact point to advise SMEs on deepfake detection, labelling, and legal requirements.