RTI S.p.a. (controller) – Complaint Upheld (Italy, 2026)

The case involves media company RTI S.p.a. (the data controller, now part of Mediaset S.p.a.) and its popular TV program Striscia la Notizia. The program aired a segment consisting of satirical, AI-generated deepfakes of known Italian personalities. Among others, the program aired footage of well known journalist and news anchorman Enrico Mentana (the data subject). The footage depicted the data subject commenting on the news in the studio where he usually worked as an anchorman, and included an AI voiceover attributing words to the data subject which he never said. The footage was extremely realistic and was based on authentic footage of the data subject which had aired on a different TV network (and which the controller had licensed from another media company). In addition to airing the footage on television, the controller also made it available via its streaming platform, on its website, and on its social channels. The data subject filed a complaint. He claimed that the footage was not clearly marked as AI and that, as a consequence, many members of the audience erroneously attributed certain opinions to him and believed that he had expressed those opinions on television. On these grounds, he claimed that the deepfake footage severely harmed his personal image and professional reputation. In its defense, the controller protested that the footage came with sufficient disclaimers that made its AI nature clear. The controller also claimed that the voiceover was obviously comedic in nature and that, therefore, the footage could not be mistaken as authentic. During its investigation, the DPA found that different versions of the footage included different forms of disclaimers and markings about its AI-generated nature: * The TV version of the footage was not marked as AI-generated. However, the show had provided viewers with a disclaimer before airing the footage; * The footage on the controller’s website was not marked as AI-generated. However, a disclaimer was present on the page that hosted the footage as well as in the video’s title; * The footage on the controller’s platform, was marked as AI-generated; * The footage on the controller’s social media channels, was not marked and did not come with disclaimers. During the procedure the controller removed some of the version of the footage but not all of them. The DPA held that overall, the controller’s disclaimers and markings were not sufficient to clarify the AI-generated nature of the footage. With regards to television footage specifically, the DPA clarified that the verbal disclaimer given during the show was insufficient, as some members of the audience had tuned into the channel when the footage was airing already. Ultimately, the DPA stated that the disclaimers should have been more evident, in order to clearly inform all viewers- including the least attentive ones. Contrary to the controller’s defenses, the DPA also held that the comedic purpose of the footage was not self-evident. In this regard, the DPA considered that the footage showed no obvious signs of manipulation and depicted the data subject in a plausible setting. Overall, the DPA found a violation of Article 5(1)(a) GDPR (“lawfulness, fairness and transparency”) as well as 25 GDPR (“data protection by design and default”). The DPA issued a warning and prohibited all further processing of the footage. In considering the sanction, the DPA took into account that the legal questions raised by deepfakes, are still relatively new.