The Office of the Data Protection Authority for the Bailiwick of Guernsey, the Isle of Man Information Commissioner and the Jersey Office of the Information Commissioner have joined forces to reinforce concerns expressed across the globe about generative AI systems that enable the creation of illicit images of people without their knowledge or consent.
While AI can undoubtedly provide benefits for individuals, organisations and society as a whole, the use of AI to create non-consensual intimate imagery, known as ‘deepfakes’, can cause emotional harm, tarnish reputations and violate people’s data protection rights.
This Data Protection Advisory provides advice to our constituents on what steps they can take to protect themselves against these risks.
Concurrent with this Advisory, the three Crown Dependency partners have signed a joint statement alongside 60 co-signatories around the world that recognises the potentially harmful content such systems can create and pledges a commitment to collectively addressing this global risk.
The joint statement makes it clear that where personal data is involved data protection and privacy legislation must be complied with, and outlines expectations for organisations developing these systems. In addition to coordinating with our global counterparts, the Crown Dependency partners are committed to engaging with their respective governments, private sectors and civil society to address these risks.
What can individuals do to protect themselves?
Whilst responsibility for data protection compliance lies with the organisations that design and use these systems, individuals can take steps to limit the use of their personal data. These steps include:
Control who can see your information and limit what you share.
Social media platforms often default to low privacy settings, meaning your posts and personal information may be visible to a wide audience. Check and update these settings so you can control who sees your content, for example by limiting access to specific people or groups. Avoid sharing large amounts of personal information with online services and AI systems, particularly images of children. If sharing information is not necessary, do not provide it. This helps reduce the risk of personal data being copied, altered, reused, or misused. We will be developing online safety advice to provide parents with practical guidance on using these settings to better protect their children.
Be cautious when using AI tools and relying on AI-generated content.
Some AI tools pose greater risks than others, especially those that ask for photos, videos, voice recordings, or detailed personal information. Be particularly careful where it is unclear how long information is kept, whether it is used to train AI models, or who it may be shared with. AI-generated text, images, and videos may be inaccurate, misleading, or entirely fabricated. It can be difficult to tell what is real and what is not. Do not rely on AI-generated content without checking it against trusted sources.
Remember that information shared with AI tools may be difficult to fully remove.
Once personal data is uploaded to an AI system, it may be stored, copied, or reused in ways that are hard to control. Even if content is deleted later, it may not be possible to guarantee that all copies have been removed.
Do not create or share AI-generated content that could harm someone.
Creating or circulating misleading, intimate, or damaging AI-generated content about a real person may be unlawful and can have serious consequences. Creating and sharing indecent images of a child is a criminal offence, regardless of whether AI is used.
Understand your data protection rights and what to do if something goes wrong.
Data protection law gives people rights over their personal information, including the right to be informed about how it is used, to access it, and in some cases to have it deleted. Children also have these rights, and parents or guardians may be able to exercise them on a child’s behalf. If personal data is misused or harmful content is created or shared, you can report it to the platform or service involved and ask for it to be removed. You may also be able to raise a concern with our office.
Talk to children about how they use online services and AI tools.
Children’s personal data requires extra protection. Help children understand their rights and the potential risks of uploading photos or personal details into apps or AI tools, even where a service appears harmless or is designed for entertainment.
If you want to use other people’s information to generate content using AI, you need to think about how you would feel if it was your information or image. If you wouldn’t like it, chances are the other person won’t either. You should let them know what you are doing and see if they are happy with the planned use. And remember - using generative AI to create indecent images of children is a criminal offense. Whether the image is real or a deepfake makes little difference to the Courts.
Brent Homan, Bailiwick of Guernsey Data Protection Commissioner, said: “The abuse of AI image systems to create ‘Deepfakes’ poses global risks that have reached our islands. By joining forces with our Crown Dependency counterparts we can better arm and protect our children against these harms.”
Dr Alexandra Delaney-Bhattacharya, Isle of Man Information Commissioner, said: “We are deeply concerned about harmful and destructive indecent imagery, including deepfakes, being generated by AI tools – including of children.
International regulators will continue to work together to confront what is now widely recognised as a growing global threat.
While organisations that design and deploy these systems hold primary responsibility for complying with data protection law there are still steps you can take to reduce the risk of your information being misused.
We strongly encourage parents and carers to talk openly with children about online dangers and play an active role in helping them stay safe.”
Paul Vane, Jersey Information Commissioner, said: “AI tools that can generate or alter images and video are advancing rapidly. When used responsibly they hold tremendous promise. But as recent reporting makes clear, they are already being used to harm real people.
It is too easy to hide behind a veil of ‘it’ll never happen to us’ and we owe it to our community, and especially our young people, to educate not just how to use AI, but how to use it ethically and safely.”
Additional resources for protecting your information can be found on the Authorities’ websites.