Spain seeks to adapt its regulations to the artificial intelligence era

The evolution of image creation technologies and the increasing prominence of artificial intelligence (AI) in recent years have unleashed a wide range of opportunities in the vast majority of sectors. 

However, this breakneck progress has also raised challenges and dilemmas, especially due to the lack of adequate regulation to match these innovations. In particular, techniques linked to the recreation of images and voices of people through artificial intelligence techniques require an enhanced protection of certain fundamental rights, such as privacy, self-image and honour.

Deepfakes and the hyperreal

In this scenario of rapid technological advances, deepfakes or hyperrealist videos stand out as one of the most recognisable exponents. These creations are defined as visual, auditory or audiovisual compositions that emulate reality, generating fictitious images and/or voices of people. Based on the use of AI and machine learning, this technology manages to recreate actions with a hyper-realistic appearance, appearing to be executed by the people in question.

This phenomenon poses significant challenges, as the ability to generate realistic content in a fictitious manner can have ethical and social repercussions, directly affecting public perception and trust in visual and audio media. Examples of this in Spain are the cases of the Almendralejo teenage girls or the well-known singer Rosalía, where in both cases, AI manipulation of images was used for the purpose of creating fake pornographic content.

Draft bill

In response to this problem, Spain has taken a significant step forward with the presentation, on 13 October 2023, of a Proposed Organic Law to regulate image and voice simulations generated by artificial intelligence. This legislative initiative recognises the imperative need to establish solid legal frameworks in order to face the emerging threat posed by this technology, especially considering that since 2009 the European Court of Human Rights has recognised the control of one's own image as an unavoidable dimension of the right to privacy.

The bill advocates for the amendment of already existing regulations. Considering that the regulation of artificial intelligence implies reforming the Spanish legal system, this initiative seeks to address the legislative modifications considered most "immediate and urgent". These amendments focus on critical areas, such as access to truthful information and the protection of fundamental rights, with a special focus on aspects such as privacy and intimacy.

Proposed amendments

The main and noteworthy proposed amendments are the following:

• Law 13/2022 on Audiovisual Communication Services: it is considered a very serious infringement to broadcast deepfakes without the express consent of the persons concerned, unless they include a clear warning about their AI origin (for example, by means of a watermark). However, the use of this technology is envisaged when authorised by law for the detection, prevention, investigation and prosecution of criminal offences, or when the content is part of a creative, satirical, artistic or fictional work.
• Organic Law 1/1982 on Civil Protection of the Right to Honour, Personal and Family Intimacy and one's own image: the dissemination and use of deepfake without the express authorisation or consent of the affected persons, unless they include a clear warning about their AI origin, is established as illegitimate intromission.
• Criminal Code: it is a criminal offence to recreate by means of deepfake technology with the intention of undermining the honour, reputation, dignity or esteem of a person, when it is publicly disseminated without the necessary authorisation. The dissemination of these recreations on social media is considered as to be an insult made with publicity.
• Law 58/2000 on Civil Proceedings: a new specific preventive measure is created consisting of the removal of images or audio generated by AI.
• Organic Law 3/2018 on the Data Protection Guarantee of Digital Rights: it is expressly regulated that the regulation applies to the processing of personal data generated by AI that is publicly disseminated.
• Law 3/1991 on Unfair Competition: the use of deepfakes or the alteration of body appearances in commercial communications, without warning of such circumstances in the commercial communication, is added as conduct constituting acts of deception.    

Furthermore, the initiative proposes the creation of two new bodies, the Citizen Participation Council, responsible for supervising and evaluating AI, made up of 12 representatives of civil society and linked to the Spanish Ministry of Science and Innovation; and the Advisory Council on the use of Artificial Intelligence, whose members will be elected by absolute majority of the Spanish Congress of Deputies from among candidates specialising in the field.

International legal framework

At an international level, there have also been regulatory developments on this matter, especially at the European Union, where the Artificial Intelligence Regulation addressing this deepfake technology and will establish a series of guidelines for its use, is expected to be approved soon. The Spanish Draft Bill will therefore have to be brought into line with the provisions of this regulation.

In addition, the recent European Digital Services Act also refers to deepfake technology by imposing an obligation on very large search engines and very large online platforms to label deepfakes as such, in accordance with the principle of transparency.

In this context, the European Parliamentary Research Service has issued the report "Tackling deepfakes in European policy", referenced in the explanatory memorandum of this bill. This report examines the risks associated with deepfakes, such as identity theft, intimidation and the impact on fundamental rights such as equality and non-discrimination, proposing measures to address these risks in various dimensions (among others, technological, creative and dissemination).

Outside Europe, South Korea has taken drastic measures by enacting a law in 2020 that prohibits the distribution of deepfakes that may cause harm to the public interest, with penalties including up to five years' imprisonment or fines of up to US$43,000. As of 10 January 2023, China has in place provisions applicable to deepfake technology providers and users that regulate procedures covering the entire life cycle of deepfake technology, from its creation to its distribution.

In contrast, in the United States, despite the absence of specific federal legislation on deepfakes, some states such as California, Texas or New York have implemented laws focusing mainly on the area of deepfake pornography.

Osborne Clarke comment

The regulatory landscape for AI in Spain is making significant progress with the launch of the AI Supervisory Agency and the recent publication of this draft bill. Although this is only a draft, it reflects the Spanish government's willingness to address this emerging challenge and  position itself as a leader in AI regulation.

With the rapid evolution of artificial intelligence and its continuous challenges, regulation is an indispensable tool to mitigate risks and maximise the benefits derived from this technology, ensuring a future in which AI is a positive force for society.

Notwithstanding the above, the Spanish government's proposal raises a number of questions. On the one hand, there is the question of whether the bill will make it through the necessary legislative processes and obtain final approval by the Spanish Parliament – and, if so, how effective will it be in practice?

Moreover, the appropriateness and necessity of some of these amendments – at least, the one on data protection – is questionable. The proposed amendment to the Spanish data protection legislation set out in this text could be considered redundant, in the sense that any data generated by an AI system that makes a natural person identifiable or identifiable is already covered by the current legislation.