Introduction
Deepfake and personal data in Turkey has become a critical legal issue as artificial intelligence tools create realistic but false audio and video content. Such manipulation often involves the unlawful processing of biometric data—faces, voices, and images—which are protected under Turkish data protection law. Victims of deepfake misuse not only face reputational harm but also serious financial and emotional damage.
In Turkey, the legal framework regulating deepfake misuse is not yet codified in a specific law. Instead, such conduct is addressed through a combination of the Turkish Penal Code (TCK), the Law on the Protection of Personal Data (KVKK, Law No. 6698), and civil law provisions on personality rights. This article explores the legal framework, remedies available to victims, and potential disputes that may arise.
1. Deepfake and Personal Data: The Legal Intersection
- A person’s face, voice, biometric identifiers, and image are explicitly considered personal data under the KVKK.
- When these are processed, altered, or shared without consent via deepfake technology, it constitutes an unlawful data processing activity.
- Misuse can also violate Article 20 of the Turkish Constitution, which guarantees the right to protect personal data and private life.
Thus, every deepfake video or audio involving a real individual potentially triggers data protection violations in addition to criminal and civil liability.
2. Legal Framework in Turkey
a) Turkish Penal Code (TCK)
- Fraud (Articles 157–158)
- If a deepfake is used to obtain money (e.g., impersonating a CEO or family member), it qualifies as fraud, often aggravated due to its commission via digital systems.
- Unauthorized Access and Data Crimes (Articles 243–245)
- If the offender hacks into accounts to create or distribute deepfakes, this constitutes unauthorized access and data interference crimes.
- Defamation and Insult (Articles 125–126)
- Deepfakes portraying a person in a humiliating way may be punished as insult or defamation.
- Defamation by False Evidence (Article 267 – False Accusation)
- Using deepfakes to falsely implicate someone in a crime may trigger liability for false accusation.
- Personal Data Crimes (Articles 135–140)
- Obtaining, recording, or disseminating biometric data (like voice or facial features) without consent is a standalone crime.
b) KVKK (Law on the Protection of Personal Data, No. 6698)
- Personal data must be processed lawfully, fairly, and with consent.
- Deepfake use without consent violates:
- Article 4: Principles of data processing (lawfulness, accuracy, purpose limitation).
- Article 5–6: Requirement of explicit consent for processing sensitive and biometric data.
- The Data Protection Authority (KVKK Board) can impose administrative fines up to millions of Turkish Lira for unlawful processing.
c) Civil Law (Turkish Code of Obligations & Turkish Civil Code)
- Personality Rights Protection (Civil Code Art. 24–25): Deepfakes infringing privacy, dignity, or reputation allow victims to demand injunctions, removal of content, and compensation.
- Tort Liability (Code of Obligations Art. 49): Victims may seek material and moral damages for harm caused by unlawful deepfake use.
3. Remedies for Victims of Deepfake Misuse
a) Criminal Remedies
- Filing a criminal complaint with the Public Prosecutor’s Office.
- Offenders may be prosecuted under fraud, data crimes, or insult provisions.
- Penalties include imprisonment and fines.
b) Civil Remedies
- Victims may bring lawsuits demanding:
- Injunctions to stop distribution of the deepfake.
- Takedown and removal orders from websites/social media.
- Compensation claims for material loss and non-pecuniary (emotional) damages.
c) Administrative Remedies
- Complaint to the KVKK Authority for unlawful personal data processing.
- Administrative fines and corrective orders against data controllers (if a platform negligently allowed deepfake use).
d) International Remedies
- If the deepfake is hosted abroad, victims may apply for cross-border content removal through:
- The Brussels Convention on the mutual recognition of judgments,
- Or platform-level complaints (e.g., Meta, YouTube).
4. Possible Legal Disputes
- Consent vs. Manipulation
- Did the individual give consent for use of their image/voice? If consent was given for one purpose but content was manipulated for another, disputes arise about the scope of consent.
- Art vs. Defamation
- Deepfakes may be defended as satire or parody. Courts must balance freedom of expression with personality rights.
- Platform Liability
- Disputes may arise over whether social media platforms are liable for hosting deepfake content. Turkish law generally treats them as intermediaries, but failure to remove content promptly after notification could create liability.
- Employer Liability
- If deepfake fraud targets a company (e.g., CEO impersonation), disputes may arise regarding internal control failures—whether the employer or bank should compensate losses caused by fraudulent transfers.
- Cross-Border Enforcement
- Deepfake distribution often occurs on foreign servers. Disputes arise about the recognition of Turkish court orders abroad.
5. Preventive Measures
- Companies should adopt multi-factor verification for financial transfers (to prevent CEO fraud deepfakes).
- Individuals should enable two-factor authentication on accounts and use watermarking for sensitive videos.
- Governments may consider specific legislation criminalizing malicious deepfake creation/distribution.
Conclusion
Deepfake technology poses new challenges for personal data protection and legal systems. In Turkey, while no specific “deepfake law” exists, current legislation covers most scenarios:
- TCK punishes fraud, data crimes, and defamation.
- KVKK ensures that biometric identifiers (faces, voices) are protected personal data.
- Civil law provides tools for removal of unlawful content and compensation.
Victims, including foreigners in Turkey, should act quickly by filing criminal complaints, civil lawsuits, and administrative complaints to protect their rights. As deepfake technology evolves, legal disputes will likely increase, particularly regarding consent, satire, and platform liability.
Yanıt yok