Identity in the Age of Synthetic Doubles: Cyprus adopts new copyright provisions on deepfakes

The Law: A New Sui Generis Right Within Copyright

In March 2026 the Cyprus House of Representatives amended the Copyright and Related Rights Law 59/1976, introducing a new sui generis right against imitations, through “deepfake products”, of the personal physical characteristics of a natural person or of a performer’s performance. The term cross-refers to Article 3(60) of the EU AI Act.

As it is stated in the preamble of the amending law, the new right is a response to the emergence of deepfake products capable of generating or manipulating realistic image, audio, or video content and creating risks of misinformation, fraud, impersonation, and serious harm to fundamental rights.

In essence, the new provisions follow closely the relevant Danish bill (on which, see Hugenholtz 2025), though less elaborated and enacted without public consultation or parliamentary debate.

The new so-called sui generis right is twofold. Section 49 provides that a deepfake imitation of a performer’s performance may not be made available to the public without express consent; Section 50 extends the same protection to every natural person’s physical characteristics — morphology, voice, biometric and behavioural features — for fifty years after death.

Enforcement follows the rules of copyright law enforcement: Sections 49(4) and 50(4) invoke Articles 13, 13A and 13C (civil action, damages, injunctions and, in commercial-scale cases, disclosure of financial documents), while Article 14 adds criminal sanctions.

The law does not expressly provide whether licensing or even transfer of the new sui generis right is possible. The absence of any specific mention of the relevant articles in the law governing these issues may be understood either as precluding any licensing or transfer or, on the contrary, as permitting it — an approach more compatible with intellectual-property mechanisms. The latter reading is also supported by the wording of the text, which provides that deepfakes are not permitted unless based on express consent — suggesting that their use would be permissible where such consent is given. It is also reinforced by the fact that, in Cypriot copyright law, total assignment of rights is in general permitted, so that reading the new right as transferable would align with the existing framework.

A Cypriot First: A De Facto Publicity Right Where Personality Protection Was Absent

The law is a double premiere: Cyprus is the first EU Member State to legislate expressly against deepfakes through copyright law, and this is the first time Cypriot private law has granted specific statutory protection to elements of personality. Indeed, Cyprus recognises no general personality, image or publicity right, nor a privacy tort; privacy protection has grown from the constitutional right to private life and from case law such as Giallouros v Nicolaou ((2001) 1A A.A.D. 558), where the Supreme Court allowed civil damages for breaches of constitutional rights.

GDPR protection is, however, available. A realistic deepfake of an identifiable person almost always processes personal data, so the data subject’s rights of objection, erasure and compensation apply. An emerging line of CJEU case law confirms that civil remedies are available for breaches of the GDPR, at least where damage is proven: under Article 82 GDPR a data subject may claim compensation where an infringement, actual damage and a causal link between them are established, mere infringement being insufficient (see Case C-300/21 Österreichische Post). For non-commercial dissemination that appropriates no market value, data-protection law may therefore be the more natural remedy.

In this context, where the amendment really has an impact is in relation to the unauthorised commercial exploitation of a person’s or a performer’s likeness. By introducing the new right, it creates a new exclusive right — in effect a special publicity right — for the specific case of unauthorised use through deepfakes. This may prove useful for performers and celebrities more generally.

As regards other existing legal mechanisms for combating deepfakes, the AI Act takes a different approach, since it mandates only transparency: Article 50(2) requires machine-readable marking of synthetic output, and Article 50(4) requires deployers to disclose deepfakes. The technical content of these obligations has since been specified: in June 2026 the Commission published the final version of the Code of Practice on Transparency of AI-Generated Content, addressing the marking and labelling requirements of Article 50(2) and 50(4). Nonetheless, the limits of a transparency-only approach are now being recognised at EU level: under the Digital Omnibus on AI, on which the European Parliament and Council reached a provisional agreement on 7 May 2026, a new prohibited practice is to be added banning AI systems that generate non-consensual sexual or intimate content (including child sexual abuse material), with effect from 2 December 2026 — moving beyond mere labelling towards an outright prohibition for this category of deepfakes.

Against that background, Cyprus’ intervention is striking — yet it rests on a paradox: copyright, primarily a property right, is enlisted to serve public-law and dignitary interests. More peculiarly, protection is confined only to deepfakes rather than expressed as a general publicity or personality right.

The Satire, Parody and Criticism Exception

Section 49(2) excludes satire and parody from the application of the new right, and Section 50(2) also includes caricature and political or social criticism in the exception — but each is subject to an override where the imitation amounts to “disinformation” creating a “serious risk” to the rights or essential interests of others. The carve-out is necessary, since an exclusive right over face, voice and behaviour would otherwise stifle memes, commentary and critical imitation; but it is precariously balanced, because two open-ended concepts narrow it. Is a satirical deepfake of a minister disinformation because it depicts something untrue, or protected criticism because its falsity is the joke? Must the risk be probable or merely possible, and is reputational discomfort enough? The consent clause therefore needs a restrictive reading: the exception should fall away only where dissemination is materially misleading and the serious risk concrete and proportionate, with an especially high threshold for political criticism. Otherwise Section 50 may protect identity at the cost of democratic parody.

Pelham II (Case C-590/23), the CJEU’s second ruling on pastiche, treats the exception as capable of protecting stylistic imitation, tribute, humour and criticism, provided the later work remains noticeably different and enters into recognisable dialogue with its source. Pastiche is not expressly mentioned in the law as an exception to the new sui generis right, but compliance with EU copyright law would require accepting as much.

Performers and Synthetic Performances: A Real Gap, an Imperfect Vehicle

The performers’ provision is the most defensible element, because it answers a real gap in Cypriot law. Existing neighbouring rights protect fixations and uses of performances, but a deepfake can imitate a voice, gesture or interpretative manner without copying any recording, and moral rights reach only distortions prejudicial to honour or reputation — not clean but unauthorised synthetic endorsements.

Furthermore, not all synthetic doubles are abusive. A growing market trades in authorised digital replicas: studios recreate ageing or deceased actors, brands licence the voices and faces of public figures for advertising, and performers monetise synthetic versions of themselves that can work in several productions at once. This is the legitimate face of the technology, and it explains why a copyright framing is tempting. Cyprus’ Law 29(I)/2026, by prohibiting the making available of a deepfake without consent, implicitly leaves room for this consensual market, while saying almost nothing about how it should be governed.

That silence is the danger. Once likeness is exploitable as property, the bargaining asymmetries familiar from copyright reappear in sharper form: an emerging performer may sign away a perpetual, worldwide right to generate synthetic performances; an estate may license a dead celebrity’s image in ways the person never authorised; an employer may treat a worker’s digital double as a work for hire. The commercial interest is therefore real and worth protecting — but it cannot be the organising principle. A coherent regime must police the terms of exploitation, not merely its existence: limiting assignment where bargaining power is unequal, reserving an inalienable dignitary core that no licence can override, and regulating post-mortem control. Commercial value flows from identity; it does not exhaust it. However, such a regime is lacking in the Cypriot amendment.

Conclusion: Keeping Dignity at the Centre of the Synthetic Self

The Danish bill (June 2025) and a Dutch legislative proposal would likewise protect realistic digital imitations through related-rights law. As Bernt Hugenholtz emphatically (noted), this is not a welcome evolution: IP regimes exist to foster markets in which rights to exploit content are traded, so framing deepfake control as a neighbouring right signals not that deepfakes are taboo but that they are “a new licensing opportunity” — a mismatch with the dignity and democratic concerns at stake.

The Cypriot legislator, however, chose this option. The justification for this choice appears weak and also sits somehow uneasily with the preamble to Law 29(I)/2026, where dignity and public-law interests are stated as a dominant raison d’être of the amendment. Whatever legal form is chosen, the deeper lesson concerns human dignity. Even where the law treats a person’s image as a tradable, intellectual-property-style asset, it retains an organic — if sometimes latent — link to personhood, since the characteristics of a person, unlike a copyright work, are not a creation but an attribute of the self. That link must shape the internal hierarchy of any likeness right, including the new Cypriot one: a degree of priority has to be reserved for its dignitary dimension, much as the moral right of integrity constrains the exploitation of a work. Human dignity may therefore legitimately restrict the consent and licensing that contractual freedom permits, withholding enforcement from arrangements that would negate the essence of the person. Such safeguards, however, are not part of the new law.

Finally, the creation of new sui generis rights at national level fragilises the European Union’s effort to harmonise intellectual-property law, multiplying divergent national regimes in precisely the field the EU has most consistently sought to unify. A patchwork of unilateral, copyright-based responses risks uneven protection, forum-shopping and legal uncertainty across borders, and a coordinated European response framed around dignity rather than property would be the more coherent path.

Image by Markus Winkler via Pexels