Can the DPDP Act Protect ‘Viral Celebrities’ from Deepfakes?

While India has no dedicated statute governing personality rights, courts and lawmakers still draw on constitutional provisions and existing statutes to interpret and enforce them. The recently operationalised Digital Personal Data Protection (DPDP) Act also adds another layer that may influence how these personality rights are interpreted and developed in India.

As more and more Indian “celebrities” are approaching various Indian courts to get their personality rights protected, it is pertinent to ask how the DPDP Act can impact the personality rights of individuals, especially when they are not “celebrities” by the general societal standard.

What are personality rights in the Indian context?

The Copyright Act can protect individuals who want to safeguard their copyrighted intellectual property, including their image, personality, or likeness. Under the Act, a person can assert the moral rights attached to their work and challenge any misrepresentation of it, which may extend to misrepresentation of their personality or image. Additionally, the Supreme Court’s Puttaswamy judgement, which upheld the right to privacy as a fundamental right, strengthens the legal basis for protecting personality rights in India.

However, the legacy of personalty property rights goes back to 1995 in India. The famous ruling in the R. Rajagopal v. State of Tamil Nadu case suggests that individuals, especially public figures, can stop others, including the press, from commercially exploiting their identity, and it strengthened the idea that privacy is a fundamental personal right that the press must respect while balancing it with the freedom of speech and expression – which empowers the freedom of the press constitutionally.

While ruling in favour of actor Rajinikanth, one of India’s most recognisable public figures, the Madras High Court noted that “celebrities” need not even prove the false representation, reputational damage or monetary loss to protect their personalities. This is particularly significant, as recent court orders have featured interim injunctions against individuals, including those utilising AI-based media outputs, who have misused the likeness of a “celebrity” for either financial gain or to malign them, which can also include morphing their images or videos with unrelated sexual imagery.

So, how will personality rights impact DPDPA?

Explaining the main intent behind the DPDP Act, Anubhab Sarkar, Managing Partner at Triumvir Law, said that the Act had not been “enacted with the primary goal of protecting personality rights.” He said the Act primarily regulates the processing of personal data and ensures that entities respect consent and the purpose for which they use the data.

Naqeeb Ahmed Kazia, Partner at CMS IndusLaw, also reiterated the same, saying that “the main intent is to protect personal data and protect against any misuse of it.”

“However, certain provisions of the Act can be read as indirectly reinforcing personality-rights protections, especially in digital contexts such as the broad definition ascribed to ‘personal data’ under Section 2 (t) of the Act, which merely says that any data of an individual who is identifiable through such data shall constitute personal data of that individual,” Sarkar affirmed. 

He also added that since the DPDP Act broadly covers personality rights, such as reputation, false endorsement, merchandising of likeness, or non-data-based persona attributes, it does not offer remedies for passing off or commercial appropriation without personal data processing. “As a result, personality rights remain governed by constitutional, tort, and IP law,” he explained.

Why do we need court orders to protect personality rights?

Since India has no dedicated Acts that define or protect personality rights, the courts have developed these rights through Article 21’s privacy protections and through trademark and copyright laws, Sarkar explained.

Because the legal framework is scattered, courts decide on a case-by-case basis whether using someone’s name, image, likeness, or voice constitutes unlawful commercial exploitation. They then balance an individual’s identity rights against free speech, artistic expression and the public’s right to information under Article 19(1)(a). Judicial rulings, therefore, fill the gaps where no single statute offers comprehensive protection.

Do the DPDP Act and Personality Rights Save Viral ‘Celebrities’?

As it is established that court orders are generally required in order to protect personality rights, the question then becomes, can personality rights, when read with the DPDP Act, protect internet users from exploitation?

Advertisements

To start with, the DPDP Act doesn’t cover public data. “There is no law, as far as I know, that provides any clarity on when you can attribute personality rights to an individual and when you cannot attribute personality rights to an individual,” said Kazia.

Then, what if someone becomes a viral celebrity overnight, or within a week, and that leads to AI-based exploitation? The recent cases involving Marathi actress Girija Oak, who condemned sexually explicit deepfake videos featuring her, and the viral tweet about a Sri Lankan woman, Priyanga, now known as ‘bandana girl’ in meme culture, show how quickly online fame can trigger misuse. She also allegedly had to leave the internet to avoid further damage to her reputation.

Referring to the IT Act or copyright infringement as possible remedies, Kazia said, “Ideally, the practical way forward is you send a legal notice to them saying, ‘Hey, can you please take it down?’ That is what you have to do. I don’t think the whole data subject framework will actually come into the picture here. It’s going to be a remedy outside of DPDP, most likely. It’s not going to be a remedy within DPDP.”

Personality rights exist to protect individuals with sustained public impact, typically celebrities, not people involved in one-off incidents, said Kazia, explaining the possible rationale behind leaving the common people out of personality rights by default. 

How does a nominee under the DPDP Act protect their personality rights?

Sarkar said the DPDP Act allows an individual to appoint a nominee for their data, but the Act remains silent on who may exercise privacy rights if the individual does not appoint a nominee under Section 14. He also said the DPDP Act does not create inheritable rights and does not automatically transfer them to legal heirs. He added that while succession laws or general civil principles may identify who can act on behalf of a deceased or incapacitated person, their relevance to the rights under the Act and Rules remains uncertain.

“With respect to deceased persons, the Act does not expressly create a post-mortem data protection right or an independent safeguard for the personal data of someone who has passed away,” he reminded. 

Kazia also said that while the data principals have the right to nominate, it is still the obligation of the data fiduciary to serve an option that lets the users choose their data-related nominee. “If the rights are not exercised via the portal, I don’t believe there will be any other way to exercise the rights,” he said about the possible unconstitutionality of third-party nominee evidence like bond papers or agreements where the data fiduciary was not part of. 

Also Read: