Abstract

The article analyses current and planned regulations on personal data protection and the right to privacy in the context of disinformation and fake news campaigns, especially those that use AI created deepfakes. The currently applicable legal provisions meant to offer protection are scattered across various acts (including the GDPR, the Copyright Law, the Civil Code or the Press Law). They also provide only partial protection (e.g. the GDPR applies only to living persons, leaving out the deceased or fictional persons). Consequently, the current regulations are ill adjusted to the rapid development of the AI technology. The duties envisaged in the AI Act, e.g. an obligation to identify the output generated by AI and deepfakes, may not be sufficient and will not become applicable until around mid-2026. The Polish legislator should consider using the implementation of the AI Act and other EU regulations as an opportunity to harmonize and update the national legal framework in this area. We also should raise awareness and educate the public about the risks and consequences of disinformation and fake news, as well as promote good practices of verifying and reporting such information.