AI Clones Raise Urgent Data Protection and Privacy Concerns

The emergence of AI cloning technology presents a complex and rapidly evolving challenge to existing data protection and privacy frameworks, particularly within the European Union's GDPR. Reports of Meta's "Project Lazarus" exploring AI management of deceased persons' social media accounts, alongside services like ELIXIR AI offering "digital immortality" through "eternal doppelgangers," highlight a burgeoning "transcendence industry" that seeks to create and utilize digital likenesses. This trend extends to deepfakes, where AI generates highly realistic images, video, and audio from minimal source material, impacting entertainment, education, and personal privacy.

A central legal question revolves around whether a person's body and voice constitute personal data. Under GDPR, the answer is unequivocally yes, as they are inherently identifiable attributes. Article 9 of GDPR specifically addresses "special categories of personal data," which includes biometric data processed for the unique identification of a natural person. The European Data Protection Board (EDPB) guidelines further reinforce that voice data is considered inherently biometric. This means that the creation of AI models from photographs, motion capture, and voice recordings involves processing personal data, and often sensitive data under Article 9, especially when used for reliable reproduction of physical or vocal likeness.

Recital 51 of the GDPR clarifies that while photographs are not systematically considered special categories of personal data, they become so when processed through "specific technical means allowing the unique identification or authentication of a natural person." This distinction is crucial: simple photo editing does not trigger Article 9, but using facial recognition or voice analysis to create a unique biometric profile does. The implications for the "transcendence industry" are profound. Companies creating digital clones must navigate stringent consent requirements, data minimization principles, and the rights of data subjects, including the right to erasure and the right to object, even posthumously.

The rapid technological advancements outpace current legal frameworks, creating a regulatory vacuum. The exploitation of "digital remains for aesthetically pleasing, politically charged, and communicative representations," termed "spectral labour" in a "postmortal society," raises significant ethical concerns beyond mere data protection. These include questions of consent from the deceased or their families, the potential for misuse, and the psychological impact on individuals and society. Urgent legislative and ethical considerations are required to ensure that the pursuit of digital immortality does not inadvertently lead to the erosion of fundamental human rights and privacy.