Introduction
The emergence of "deepfakes," highly realistic synthetic media generated by artificial intelligence (AI), presents a significant challenge to legal systems worldwide. This technology allows for the creation of convincing but fake video and audio content, which can be used for various purposes, from satire to malicious acts such as creating non-consensual pornography, spreading political disinformation, and committing fraud. This essay will assess the adequacy of the current legal framework in the Republic of Mauritius to address the issue of legal accountability for the creation and dissemination of harmful deepfakes. It will argue that while existing laws, particularly in the areas of data protection, cybercrime, and civil liability, provide some potential avenues for redress, they were not designed to tackle the specific complexities of AI-generated content. Consequently, there are significant gaps and practical challenges that hinder the effective establishment of legal accountability, suggesting that a more specific legislative approach may be necessary.
The Nature of the Deepfake Challenge
Deepfake technology utilises deep learning, a form of AI, to superimpose existing images and videos onto source images or videos. The result is a synthetic media file that can make it appear as though a person said or did something they never did. The increasing accessibility and sophistication of this technology lower the barrier for creating convincing fakes, amplifying its potential for misuse. The harms are diverse, ranging from individual reputational damage and psychological distress caused by deepfake pornography or defamatory content, to societal-level threats like undermining trust in digital media and influencing democratic processes through fake political statements (Chesney and Citron, 2019). Establishing legal accountability is therefore crucial, but it is complicated by the ease with which creators can remain anonymous and distribute content across jurisdictions via online platforms.
Civil Liability and Data Protection Framework
The Mauritian legal system offers some potential civil remedies for victims of harmful deepfakes, primarily through the law of delict and the Data Protection Act 2017. The primary basis for civil liability is found in the Mauritian Civil Code, which is derived from the French Napoleonic Code. Article 1382 states that any act of man that causes damage to another obliges the person by whose fault it occurred to repair it. A deepfake that harms a person's reputation by depicting them in a false and damaging light could constitute a "faute" (fault), allowing the victim to claim damages. For instance, a deepfake falsely showing a business leader making a racist comment would almost certainly cause prejudice and give rise to a claim. However, a key challenge is identifying the creator of the deepfake to hold them accountable, a task made difficult by online anonymity.
More specifically relevant to the technology is the Data Protection Act 2017 (DPA). This Act, which is modelled on the European Union's General Data Protection Regulation (GDPR), provides a strong framework for the protection of personal data. A person's image and voice are considered 'personal data' under the Act's definitions. The creation of a deepfake involves the 'processing' of this personal data. According to section 25 of the DPA, processing of personal data is lawful only if the data subject has given their consent. The creation and distribution of a deepfake using someone’s likeness without their permission would therefore constitute unlawful processing. Victims could, in principle, lodge a complaint with the Data Protection Commissioner. Section 30 of the DPA makes it an offence to process personal data unlawfully. A person found guilty of such an offence is liable to a fine and imprisonment. This provides a direct legal tool against the creator of a deepfake, provided they can be identified. Furthermore, the DPA grants individuals the right to erasure of their personal data, which could be used to compel a website host in Mauritius to remove a harmful deepfake.
The Criminal Law Framework
The Mauritian criminal law framework contains several provisions that could be applied to prosecute the creators and distributors of malicious deepfakes. The Cybercrime and Computer Misuse Act 2003 is a key piece of legislation. Although enacted long before deepfakes became a widespread concern, some of its sections are potentially applicable. For example, section 14 criminalises the use of an information and communication service to cause annoyance, humiliation, or distress to any person. A deepfake designed to harass or bully an individual would likely fall under this provision. Similarly, section 15 makes it an offence to send a message that is "obscene, indecent, abusive, or threatening," which could cover non-consensual pornographic deepfakes.
Additionally, the Information and Communication Technologies Act 2001 (ICTA), as amended, contains broad provisions against harmful online content. Section 46(h)(a)(ii) makes it an offence to use an information and communication service to send a message that is "grossly offensive, or of an indecent, obscene, menacing, or false character." A deepfake that spreads false information or is of an obscene nature could be prosecuted under this section. The Information and Communication Technologies Authority (ICTA) is also empowered to issue directions for the removal of such content from online platforms. While this provides a mechanism for removing harmful content, it focuses on the content itself rather than holding the original creator accountable.
For deepfakes used in fraudulent schemes, provisions in the Mauritian Criminal Code concerning fraud or swindling could also be invoked. For example, a deepfake that convincingly mimics a CEO's voice to authorise a fraudulent bank transfer would be an instrument of a crime prosecutable under existing fraud laws.
Assessing the Gaps in Legal Accountability
Despite these potential legal avenues, the existing framework in Mauritius has several limitations when it comes to effectively tackling deepfakes.
First, the laws are not specific. They are general provisions designed for older forms of digital harm, such as text-based harassment or simple image manipulation. They do not address the unique characteristics of AI-generated synthetic media, such as the sophistication of the deception and the intent behind it. This lack of specificity could lead to judicial uncertainty when applying these laws to deepfake cases. For example, a defence lawyer might argue that a deepfake is not a 'message' in the traditional sense intended by the drafters of the ICTA or the Cybercrime Act.
Second, a major practical barrier is the issue of anonymity and jurisdiction. Deepfake creators often use anonymising tools and operate from outside Mauritius. While Mauritian law may have extraterritorial reach in some circumstances, enforcing it against an unknown individual in a foreign country is practically very difficult, if not impossible. This significantly undermines the goal of holding creators accountable.
Third, the question of intent (mens rea) in criminal law presents a challenge. To secure a conviction under many of the relevant criminal provisions, the prosecution must prove that the creator had a malicious intent. A person who creates a deepfake might claim it was intended as satire, parody, or art, making it difficult to prove the necessary criminal intent, especially if the content is not explicitly obscene or defamatory.
Finally, the liability of intermediaries, such as social media platforms that host and spread deepfakes, is not clearly defined. While the ICTA provides for take-down notices, this is a reactive measure. It does not address whether platforms have a proactive duty to prevent the spread of such content or whether they can be held liable for the harm caused. Without clearer rules on intermediary liability, a key part of the distribution network for deepfakes remains largely unaccountable (Appavoo, 2021).
Conclusion
In conclusion, the Mauritian legal framework provides a foundational but incomplete toolkit for addressing the challenges posed by deepfakes. Civil actions under the Civil Code and complaints under the Data Protection Act 2017 offer avenues for individual redress, while provisions in the Cybercrime and Computer Misuse Act 2003 and the ICTA 2001 allow for criminal prosecution in some cases. However, these laws are general in nature and are ill-equipped to handle the specific technological and practical complexities of deepfakes, such as the difficulty of identifying creators and the nuanced issue of intent. The current framework is reactive, focusing on content removal rather than proactively holding creators and distributors accountable. To ensure genuine legal accountability, Mauritius may need to consider legislative reform specifically tailored to synthetic media. This could include creating new offences related to the malicious creation of deepfakes, introducing requirements for the labelling of synthetic media, and clarifying the legal responsibilities of online platforms. Without such an update, the legal system will continue to lag behind the technology, leaving victims with limited recourse and society vulnerable to the harms of digital deception.
References
Appavoo, C. (2021) Mauritius Chapter. In: Syed, A. (ed.) The Global Handbook of Media Accountability. London: Routledge.
Chesney, R. and Citron, D. (2019) 'Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security', Lawfare Research Paper Series, No. 19-08.
Legislation (Mauritius)
Cybercrime and Computer Misuse Act 2003
Data Protection Act 2017
Information and Communication Technologies Act 2001
The Civil Code of Mauritius
The Criminal Code
