Most cases filed against AI software have focused on copyright claims. However, the case ofLehrman v. Lovo Inc("Lovo Case") offers a fresh perspective by invoking New York Civil Rights Law, Deceptive Practices Law, False Advertising Law and claims under Unfair Competition and False Affiliation, Unjust Enrichment, Tortious interference with advantageous business relationships, and Fraud. Diverging from conventional legal strategies, this case stands out for raising publicity rights and consent issues.
This series of articles, explores the causes of action Lehrman could bring against Lovo under Indian Law. This first article explores whether Indian Digital Personal Data Protection Act, 2023 ("DPDPA") would be implicated. Future articles will discuss the implications under Consumer Protection Law, Publicity Rights Claims and Trade Mark Rights.
Facts: Lovo Case
The Lovo AI service offers text-to-speech solutions that generate voice-over narrations from user-uploaded scripts. Lovo uses actors' voices to train the service and then generate the output as per user choice. Lovo provides a platform named "Generator" or "Genny" that allows users to create professional-quality voice-overs. Users can select various voice preferences, including gender, regional accents, and age tones. The lawsuit claims that Lovo used the voices of two actors (Lehrman and Sage) without their consent and initially misled them when seeking permission.
Lovo allegedly reached out to the actors, stating that their voices would be used solely for academic research purposes. However, it is alleged that the voice files created would be used to develop an AI service. Therefore, Lovo did not obtain the actors' consent for using their voices for the actual purpose they were employed, and further concealed or failed to disclose the true purpose for which they required the actors' voices.
The voices were reportedly utilized for various purposes without consent, such as on a YouTube channel that promotes Russian military equipment and in an episode of the podcast "Deadline Strike Talk," which discusses the dangers of AI technologies. Lovo's service also used the names and likenesses of famous individuals, such as Barack Obama, Conan O'Brien, and Elton John. Additionally, it mentions an AI avatar named "Samantha," resembling Scarlett Johansson's character in the movie "Her."
Potential Causes of Action under Indian Data Protection Laws:
- Voice/likeness constitutes personal data:
The DPDPA defines personal data underSection 2(h)as "a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means". Personal data arguably, under the definition, encompasses voice recordings and visual representations like photographs or videos. Since an individual's voice and likeness are unique identifiers that can directly or indirectly reveal their identity, they are accorded protection under the DPDPA as personal data.
- Consent must be explicit:
Explicit consent is required to be obtained from individuals/Data Principals, before processing their voice or likeness data underSection 4of the DPDPA. Further,Section 6of the DPDPA underlines the conditions for valid consent. Some of the key conditions are listed below:
- Section 6(1): The consent given by the Data Principal must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action".The purpose for which the data is being processed must be specified clearly and the data is to be limited to such personal data as is necessary for that specific purpose.
- Section 6(3): The consent must be obtained in a manner that is easy to understand, in clear and plain language.
- Section 6(4): The Data Principal has the option to withdraw consent as easily as it was given.
- Purpose to be clearly explained:
The DPDPA provides underSection 5(1)that when the Data Fiduciary issues a notice requesting consent from the Data Principal, the notice must clearly inform her of the required personal data and purpose for which the data is proposed to be processed.
- Permission required for each specific purpose:
UnderSection 7(a)of the DPDPA, a Data Fiduciary may process the personal data of an individual "for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data." Therefore, the DPDPA provides a safeguard to the Data Principal, ensuring they are aware of every specific purpose for which their data is being processed and that they have given their full consent for each specific purpose. Thus evidently, prior consent is required for use of voice for training AI softwares.
However, an argument may be made that that actors' voices are already in the public domain due to the extensive content they have lent their voices to, which is widely accessible to the public. The Services like Lovo may therefore rely on the exemption under Section 3(c) which provides that the Act will not apply if the Data Principal to whom the personal data relates has made the data publicly available or caused the data to be made publicly available. While Lovo may attempt to rely on this exemption to argue that the personal data, i.e., the voice and likeness, belonging to the actors was publicly available through their movies or social media, the actors may counter this argument by relying on the Right to Privacy judgments of the Constitutional Benches of the Supreme Court of India. These judgments hold that merely because a person is in a public place does not mean that he/she has no right to privacy. In this regard the judgements hold as follows:
"...While the legitimate expectation of privacy may vary from intimate zone to the private zone and from the private to the public arena, it is important to underscore thatprivacy is not lost or surrendered merely because the individual is in a public place. Privacy attaches to the person since it is an essential facet of the dignity of the human being..."
"...the notion of reasonable expectation of privacy has both subjective and objective elements. At a subjective level it means 'an individual desires to be left alone'. On an objective plain privacy is defined by those Constitutional values which shape the content of the protected zone where the individual 'ought to be left alone'. Further, the notion of reasonable expectation of privacy ensures that while on the one hand, the individual has a protected zone of privacy, yet on the other 'the exercise of individual choices is subjectto[sic.] the right of others to lead orderly lives'. The extent of the zone of privacy would, therefore, depend upon both the subjective expectation and the objective principle which defines a reasonable expectation..."
"...'Reasonable Expectation' involves two aspects. First, the individual or individuals claiming a right to privacy must establish that their claim involves a concern about some harm likely to be inflicted upon them on account of the alleged act. This concern 'should be real and not imaginary or speculative'. Secondly, 'the concern should not be flimsy or trivial'. It should be a reasonable concern. It has to be borne in mind that the concept of 'reasonable expectation' has its genesis in the US case laws. UK judgments adopted the test of reasonable expectation from the US jurisprudence. ..."
"Therefore, when a claim of privacy seeks inclusion in Article 21 of the Constitution of India, the Court needs to apply the reasonable expectation of privacy test. It should, inter alia, see:
(i) What is the context in which a privacy claim is set up?
(ii) Does the claim relate to private or family life, or a confidential relationship?
(iii) Is the claim a serious one or is it trivial?
(iv) Is the disclosure likely to result in any serious or significant injury and the nature and extent of disclosure?
(v) Is disclosure relates to personal and sensitive information of an identified person?
(vi) Does disclosure relate to information already disclosed publicly? If so, its implication?"
Therefore, while Lovo may attempt to invoke the exemption under Section 3(c) of the DPDPA, the actors could argue that the Supreme Court's jurisprudence on data privacy and the fundamental right to privacy under Article 21 of the Constitution mandates that even publicly available personal data, such as their voice and likeness, cannot be processed without their consent and in violation of data protection principles. The actors could assert that Lovo's unauthorized use of their voice and likeness, even if publicly available, constitutes a violation of their fundamental right to privacy and data protection as the initial consent was limited to use of their voice/ likeness for the film or web-series and not to train an AI Service.
Potential Penalties
Data Fiduciaries like Lovo can face substantial penalties for failing to comply with the provisions of the DPDPA. If found in violation of the DPDPA's provisions, such as failing to obtain valid consent, not adhering to data protection principles, or compromising data security, they could potentially face substantial penalties ranging from INR 10,000 to INR 250 Crores, depending on the nature and severity of the violation.
footnote
1 K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1followed byK.S. Puttaswamy (Aadhaar-5J.) v. Union of India, (2019) 1 SCC 1.
To view original article link/click here
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.