In brief

Samir Safar-Aly, Financial Regulatory Counsel and the firm’s MENA FinTech & AI Lead, recently spoke with Arabian Business regarding AI and deepfakes, answering the following questions:

What legal recourse do UAE residents have for deepfakes, voice theft or IP infringement by AI? What would such a lawsuit look like here in the UAE?

As with most emerging and/or enabling technologies that do not have a specific dedicated legal framework, we often find that exploring existing laws need to be interpreted in view of the current technological realties to find relevance and legal recourse. AI is a perfect example of this issue, in addition to other issues such as Web3, metaverse and, until recently, virtual assets/crypto (prior to the UAE financial regulators issuing specific regulations and guidance, as well as the establishment of the world’s first dedicated virtual asset regulator in Dubai — the Virtual Asset Regulatory Authority (VARA)).

With the development of Generative AI that can generate or modify audio and video content that was never recorded, and advances in deep learning (specifically through a technique known as ‘Generative Adversarial Networks’ – or ‘GANs’), deepfakes have become a reality more than ever before. Needless to say, deepfakes can become a significant threat when used to distribute fake media and information, damage reputations (of individuals, companies or countries), fabricate evidence, and defame, among other malicious and harmful actions. As such, what the legal recourse is under UAE law depends largely on what the use and impact of the deepfake entails.

To the extent that deepfakes result in defamation, the UAE Penal Code (Federal Decree-Law No. 31 of 2021, as amended) penalizes such actions under Article 425 or Article 426 (depending on the effect of the deepfake), which may result in imprisonment or a fine. When defamation is conducted through digital means (which would be the case with a deepfake), Article 44 of UAE Federal Decree-Law No. 34 of 2021 on Combatting Rumors and Cybercrimes, as amended (“UAE Cybercrimes Law“), increases this to a prison sentence of up to one year and/or a criminal fine between AED 250,000 and AED 500,000 per offense.

Similarly, if the actions conducted by or through a deepfake amount to fraud (by obtaining a “benefit” through seeking a fraudulent method or by false pretense or capacity so as to deceive a victim), Article 451 of the UAE Penal Code stipulates that this will lead to imprisonment or a criminal fine (even attempted fraud will lead to up to two years in jail or a fine of up to AED 20,000). When this is done electronically (which would be the case with a deepfake), Article 40 of the UAE Cybercrimes Law, considers this “Cyber Fraud”, which carries a minimum of one year’s imprisonment and/or a criminal fine between AED 250,000 and AED 1 million per offence. Additionally, the UAE Cybercrimes Law makes it a crime to use technology as a conduit for “breaching the privacy of a person or the private or family life of individuals without consent” (which is defined, among other things, as “spreading news, electronic images, photographs, footage, comments, data or information, even if true and correct, to harm such person”). Such actions may carry a penalty of no less than six months’ imprisonment and/or a fine between AED 150,000 to AED 500,000, again, per offence.

Other offenses under the UAE Cybercrimes Law that are potentially relevant to deepfakes (depending on the circumstances) include extortion, threat, and/or spreading rumors and fake news, all of which carry with them significant criminal penalties. Interestingly, Article 54 specifically makes it a crime to create or modify ‘Electronic Robots’ (defined simply as an electronic program created or modified to carry out automated tasks efficiently and quickly) for the purpose of publishing, republishing, or circulating fake data or news (or even just enabling others to do the same – which potentially might have implications for platforms that spread such content). This carries a penalty of up to two years’ imprisonment and a fine between AED 100,000 and AED 1 million.

Article 58 of the UAE Cybercrimes Law extends the outlined penalties to persons “de facto” in charge of management of corporate entities that have taken part in any of the crimes mentioned, if (a) such persons had knowledge of the actions that took place, and (b) a breach of their management duties contributed to the commission of such crimes. The juristic person (i.e., the legal entity) in question is deemed, under the same provision, to be jointly held liable for the judged fines or remedies, if the offence is committee by an employee, in the name and favor of that corporate entity. In all such cases, Article 59 of the UAE Cybercrimes Law permits the UAE Courts to shut down or block any offending website (for example, a website or service that hosted such deepfake). In other words, liabilities for deepfakes can extend to corporate entities involved, and potentially their management. 

If a victim would like to seek recourse under the penal measures mentioned, this first starts with reporting the issue to the relevant Police Directorate in the emirate where they are based, such as Dubai Police, Abu Dhabi Police, etc. (who will then consider and potentially transfer the issue to the relevant public prosecution agency in the emirate concerned – e.g., Dubai Public Prosecution, Abu Dhabi Public Prosecution, etc.). Under the UAE Civil Transactions Law, Article 292 allows an aggravated person to potentially seek damages as a form of compensation for a wrong committed or a harm caused (which could potentially include loss of profits, should that be the case). This would be done through filing a claim at the courts in the emirate where the person is based — it all depends on what the deepfake’s impact was.

On the topic of IP, we have witnessed a number of cases globally on the topic of copyright infringement and generative AI — both with regard to copyrighted content being used in training AI systems and with regard to output. As with most copyright laws globally, for example, the UAE Copyright Law (Federal Decree-Law No. 38 of 2021) refers to the ‘Author’ of a ‘Work’ being a “person” (which can be natural or legal). The question of whether generative AI content is copyrightable in the first place remains a contested issue globally, as do the implications of copyright infringement by generative AI models.

Click here to access the rest of the questions.