1. Introduction

The Deepfake Biomarker Governance Doctrine is an emerging legal and regulatory framework concerned with the creation, manipulation, reproduction, misuse and distribution of artificially generated biological or biometric information through artificial intelligence (AI).

It addresses situations in which AI technologies generate or manipulate information that appears to represent an individual's biological characteristics, identity or physiological condition.

Examples include:

AI-generated facial and iris patterns that imitate a real person's biometric identity.

Artificially cloned voices used to impersonate individuals.

Deepfake medical images that falsely indicate the presence of a disease.

Manipulated DNA or genetic reports used to misrepresent biological identity.

Synthetic EEG signals falsely suggesting neurological conditions.

AI-generated physiological records used to manipulate medical, employment or insurance decisions.

Fabricated biometric authentication records used for financial fraud or unlawful surveillance.

The doctrine raises important questions:

Who is legally responsible for creating a synthetic biomarker?

Can biometric information be collected without informed consent?

How should courts distinguish authentic biological evidence from AI-generated evidence?

What obligations should AI developers and healthcare institutions have?

Can an individual obtain compensation for the misuse of synthetic biological identity?

What safeguards should govern the use of AI-generated biomarkers in criminal investigations?

Important legal clarification: Deepfake Biomarker Governance Doctrine is not currently a formally recognised, independent legal doctrine established by a particular court. It is a proposed analytical framework developed by combining constitutional privacy, biometric-data protection, medical regulation, AI accountability, personality rights, evidence law and intermediary liability.

2. Meaning and Scope of Deepfake Biomarker Governance

A biomarker is a measurable biological characteristic that can indicate a biological process, physiological condition or disease.

Examples include:

Genetic biomarkers.

Blood biomarkers.

Neurological biomarkers.

Voice-related physiological characteristics.

Facial and behavioural characteristics.

Cardiovascular indicators.

Hormonal indicators.

Retinal and iris characteristics.

Biomarkers and biometric identifiers are related but are not interchangeable. A biometric identifier is primarily used to recognise or authenticate an individual, whereas a medical biomarker may indicate a health condition.

Deepfake technology creates an additional legal problem because AI can produce artificial representations that appear to be genuine biological information.

For example, suppose an AI system generates a fabricated neurological report showing that an individual has a particular neurological disorder. An employer subsequently rejects that individual based on the fabricated report.

This situation involves several potential legal violations:

Misrepresentation of personal information.

Privacy and data-protection violations.

Discrimination.

Professional negligence, where applicable.

Civil liability for reputational or financial injury.

Criminal liability if the conduct satisfies the elements of an applicable offence.

The governance doctrine seeks to establish responsibility throughout the entire process, from data collection to AI generation, verification, distribution and subsequent use.

3. Constitutional Foundations of the Doctrine

A. Right to Privacy

The constitutional foundation of deepfake biomarker governance is the right to privacy.

In India, Article 21 of the Constitution protects life and personal liberty. The right to privacy includes informational privacy, dignity and individual autonomy.

The most important judgment is:

Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1.

The Supreme Court recognised privacy as a fundamental right under the Constitution.

The judgment established important principles:

Individuals have an interest in controlling personal information.

Privacy protects human dignity and autonomy.

State interference with privacy must satisfy constitutional requirements.

Informational privacy is an important component of personal liberty.

Application to deepfake biomarkers:

If an organisation collects facial geometry, genetic information, voice recordings or neurological data without an appropriate legal basis and uses those materials to create deceptive synthetic representations, constitutional privacy concerns may arise.

The Puttaswamy judgment provides the constitutional foundation for examining such conduct, although it did not directly decide an AI deepfake biomarker dispute.

B. Right to Human Dignity and Identity

The doctrine also protects individuals against unauthorised manipulation of their biological and digital identity.

A synthetic biometric representation may falsely associate an individual with:

Criminal conduct.

Medical conditions.

Political statements.

Financial transactions.

Sexual conduct.

Professional misconduct.

Such manipulation can damage dignity, reputation and personal autonomy.

The constitutional analysis should therefore consider Articles 14, 19 and 21, depending on the circumstances and the identity of the defendant.

C. Equality and Non-Discrimination

Article 14 provides protection against arbitrary State action and requires equality before the law.

Suppose a government agency uses an AI-generated biometric report to classify certain individuals as medically or socially risky without reliable evidence.

The decision may raise questions concerning:

Arbitrary classification.

Discriminatory treatment.

Procedural fairness.

Reliability of automated decision-making.

Availability of an effective appeal.

The doctrine therefore requires meaningful safeguards before synthetic or AI-processed biological information is used in decisions affecting individuals.

4. Major Governance Principles

A. Consent and Biological Data Collection

The first principle is informed and lawful data collection.

An AI developer should not assume that publicly available facial photographs, voice recordings or genetic information can automatically be used for every subsequent purpose.

Governance should examine:

Whether the information identifies an individual.

Whether consent or another lawful basis exists.

Whether the purpose of collection was disclosed.

Whether the data is being used for an incompatible purpose.

Whether the information is being retained securely.

Whether the individual can exercise applicable legal rights.

The Indian Digital Personal Data Protection Act, 2023 is relevant because it regulates the processing of digital personal data.

Importantly, it does not create a separate comprehensive biometric-data category equivalent to the sensitive-data classifications found in some other legal systems.

B. Biomarker Authenticity

A second principle is authenticity verification.

An organisation using biomarkers should distinguish between:

Original biological information.

Digitally enhanced information.

AI-generated biological representations.

Altered or manipulated records.

Unverified third-party information.

For example, a hospital should not treat an AI-generated medical image as an authentic diagnostic record merely because it appears realistic.

Appropriate safeguards may include:

Source verification.

Laboratory validation.

Digital provenance.

Independent expert examination.

Audit trails.

Model documentation.

Human clinical review.

C. Algorithmic Transparency

AI systems that generate or analyse biomarkers should maintain adequate documentation.

Such documentation should explain:

The origin of the training data.

The intended purpose of the model.

The limitations of the technology.

The possibility of synthetic manipulation.

The validation methodology.

The known error rates.

The process for challenging incorrect outputs.

Transparency becomes particularly important where AI-generated information influences healthcare, insurance, criminal justice or employment decisions.

D. Accountability and Liability

The doctrine rejects the assumption that responsibility automatically belongs only to the person who uploads a deepfake.

Depending on the facts, responsibility may arise at different stages:

Liability must be determined according to the conduct, applicable law, causation and available defences. It does not arise automatically merely because a party participated in an AI-related activity.

5. Important Case Laws and Judicial Principles

Although courts have not yet established a separate doctrine specifically called Deepfake Biomarker Governance, several judgments provide its legal foundations.

Case 1. Anil Kapoor v. Simply Life India & Ors. (2023)

Citation: CS(COMM) 652/2023, Delhi High Court, order dated 20 September 2023.

Important Indian AI case

Facts:

Actor Anil Kapoor approached the Delhi High Court seeking protection against unauthorised commercial use of his name, voice, image, likeness and other personality attributes.

The allegations included:

AI-generated images and videos.

Face morphing.

Fake pornographic content.

Unauthorised voice and image exploitation.

Misuse of his identity through online platforms.

Decision:

The Delhi High Court granted an interim injunction protecting his personality rights and restrained specified defendants from misusing his identity through AI, machine learning, deepfakes and other technologies.

Legal principles:

A person's identity and personality attributes deserve legal protection.

AI technology cannot justify unauthorised exploitation of identity.

Privacy and dignity remain relevant in digital environments.

Courts can grant injunctive relief against unlawful synthetic representations.

Application to the doctrine:

The judgment provides an important foundation for protecting facial, vocal and other identity-related characteristics against unauthorised synthetic reproduction.

It is particularly relevant where biometric material is used to generate a deceptive representation of a real person.

Indian Kanoon+1

Case 2. Justice K.S. Puttaswamy v. Union of India (2017)

Citation: (2017) 10 SCC 1.

Facts:

The Supreme Court considered whether privacy constitutes a fundamental right under the Indian Constitution.

Decision:

A nine-judge constitutional bench unanimously recognised privacy as a fundamental right.

Legal principles:

Informational privacy.

Personal autonomy.

Human dignity.

Individual control over personal information.

Constitutional limitations on State interference.

Application:

If an organisation uses an individual's genetic, facial, vocal or physiological information to create a synthetic identity without an appropriate legal basis, the Puttaswamy framework becomes relevant.

It supports constitutional scrutiny of unlawful collection and manipulation of personal information.

Case 3. Patel v. Facebook, Inc. (2019)

Citation: 932 F.3d 1264 (9th Cir. 2019).

Facts:

Facebook users alleged that its facial-recognition technology collected and stored face templates without complying with Illinois biometric privacy requirements.

Decision:

The Ninth Circuit upheld class certification and recognised that an alleged violation of biometric privacy protections could constitute a concrete injury.

Legal principles:

Facial templates can involve legally protected biometric information.

Collection procedures and consent requirements matter.

Biometric privacy violations can create legally cognisable injury.

Organisations must consider statutory retention and disclosure obligations.

Application:

The judgment is relevant to deepfake biomarker governance because biometric information may be collected and processed before it is used to create synthetic identities.

It demonstrates that the initial collection and storage of biometric information can itself raise legal liability, independently of subsequent deepfake publication.

Justia Law+1

Case 4. Titan Industries Ltd. v. Ramkumar Jewellers (2012)

Citation: 2012 SCC OnLine Del 2382.

Facts:

The dispute concerned the unauthorised use of celebrity images in commercial advertising.

Legal significance:

The Delhi High Court recognised the importance of personality and publicity rights in protecting commercial identity.

Application:

The principle can be extended to situations where a person's face, voice or other recognisable identity characteristics are used in synthetic advertisements, AI-generated endorsements or deceptive biometric representations.

The case does not directly concern deepfake technology, but its personality-rights reasoning is relevant.

Case 5. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

Citation: (2020) 7 SCC 1.

Facts:

The Supreme Court examined the admissibility requirements for electronic records under Section 65B of the Indian Evidence Act, 1872.

Decision:

The Court clarified the importance of the statutory certificate for admissibility of electronic records, subject to the requirements and exceptions recognised by the law.

Application:

A deepfake video, synthetic voice recording or manipulated biomarker report cannot be treated as authentic simply because it exists in electronic form.

Its origin, integrity, creation process and evidentiary reliability must be examined.

The present equivalent electronic-record framework is principally contained in Section 63 of the Bharatiya Sakshya Adhiniyam, 2023.

Case 6. Anvar P.V. v. P.K. Basheer (2014)

Citation: (2014) 10 SCC 473.

Legal principles:

The Supreme Court established important requirements concerning the admissibility of electronic evidence under Section 65B of the former Evidence Act.

Application:

A fabricated biometric recording may be challenged through questions concerning its authenticity, source, integrity and statutory admissibility.

A certificate establishing compliance with electronic-record requirements does not, by itself, establish that the underlying content is biologically or factually genuine.

Case 7. The Information Commissioner v. Clearview AI Inc. (UK Upper Tribunal, 2025)

Proceedings: UKUT 319 (AAC), concerning the reach of data-protection regulation over facial-image scraping and facial recognition.

Facts:

Clearview AI collected publicly accessible facial images, converted them into searchable facial vectors and maintained a large facial-recognition database.

Legal significance:

The proceedings examined the application and territorial reach of data-protection rules to large-scale facial-data collection.

Application:

The case illustrates why public availability of a facial photograph does not automatically resolve questions about lawful biometric processing, jurisdiction and individual privacy.

Bailii

6. Indian Statutory Framework

The governance doctrine can be developed through several existing Indian enactments.

These provisions apply only where their respective statutory elements are satisfied. For example, not every deepfake constitutes cheating, forgery or an obscene publication.

A. Information Technology Act, 2000

The IT Act provides several possible remedies.

Section 66C – Identity theft

It may apply where another person's electronic signature, password or unique identification feature is fraudulently or dishonestly used.

Section 66D – Cheating by personation using a computer resource

It may apply where a deepfake voice or video is used to impersonate another person and cheat someone.

Example: An individual creates an AI-generated voice of a company director and instructs an employee to transfer money.

Section 66E – Violation of privacy

This provision addresses specified intentional or knowing capture, publication or transmission of images of a person's private areas without consent, in violation of the statutory conditions.

It should not be treated as a general provision covering every manipulated biometric image.

B. Digital Personal Data Protection Act, 2023

The DPDP Act is important because digital biometric and biomarker information may constitute personal data when it relates to an identifiable individual.

Relevant provisions include:

Section 4: Grounds and conditions for processing personal data.

Section 6: Consent requirements.

Section 8: General obligations of Data Fiduciaries.

Section 8 also addresses accuracy and completeness in specified circumstances, including where personal data is likely to be used to make a decision affecting the individual or disclosed to another Data Fiduciary.

This is particularly significant where inaccurate AI-generated information influences a medical, employment or financial decision.

However, the Act does not expressly establish a comprehensive standalone regime for synthetic biomarker detection. Its actual application also depends on its commencement notifications and applicable rules.

C. Bharatiya Nyaya Sanhita, 2023

The BNS may provide criminal remedies where synthetic biological or biometric information is used for unlawful purposes.

Relevant provisions include:

Section 318: Cheating.

Section 319: Cheating by personation.

Section 336: Forgery.

Section 356: Defamation.

For example, a person who creates a fabricated genetic report and uses it to obtain money through deception may attract criminal provisions if their conduct satisfies the relevant elements.

D. Bharatiya Sakshya Adhiniyam, 2023

Section 63 provides the statutory framework for admissibility of electronic records.

This is particularly important in deepfake-related litigation.

A court may need to consider:

Whether the electronic record is authentic.

Whether the recording has been altered.

Whether its source can be established.

Whether its production history is documented.

Whether expert examination is necessary.

Whether statutory admissibility requirements have been fulfilled.

Central distinction: Electronic admissibility and factual authenticity are separate questions. A properly certified electronic record may still contain fabricated information.

7. International Governance Framework

Deepfake biomarker governance also draws on international data-protection and AI-governance principles.

A. European Union – GDPR

The General Data Protection Regulation (GDPR) provides significant protections for personal information.

Relevant provisions include:

Article 4: Definitions of personal data and biometric data.

Article 5: Principles of data processing.

Article 6: Lawfulness of processing.

Article 9: Special-category personal data, including biometric data used for uniquely identifying a person and genetic data.

Article 22: Certain decisions based solely on automated processing.

These provisions are relevant when AI systems collect, process or generate information relating to identifiable individuals.

B. European Union AI Act

The EU Artificial Intelligence Act introduces risk-based regulation of AI systems.

Its framework includes:

Risk classification.

Requirements for high-risk AI systems.

Data governance.

Technical documentation.

Human oversight.

Transparency obligations for specified synthetic content.

Article 50 is particularly relevant to transparency concerning certain AI-generated or manipulated content, including deepfakes.

The AI Act does not establish a universal prohibition on all deepfake biomarkers. Its requirements depend on the particular system, application and applicable provision.

C. International Human Rights Principles

International human rights principles also support protection against misuse of biological identity.

Relevant instruments include:

Universal Declaration of Human Rights, Article 12.

International Covenant on Civil and Political Rights, Article 17.

UNESCO Recommendation on the Ethics of Artificial Intelligence, 2021.

UNESCO International Declaration on Human Genetic Data, 2003.

These instruments provide important principles concerning privacy, dignity, autonomy and responsible scientific development.

8. Deepfake Biomarker Governance: Practical Regulatory Model

A comprehensive governance framework should operate through the following stages.

Seven-stage governance architecture

Stage 1 – Lawful data collection

Establish a lawful basis for collecting genetic, facial, vocal and physiological information.

Stage 2 – Consent and purpose limitation

Identify permitted uses and prevent unauthorised secondary exploitation.

Stage 3 – AI model validation

Test systems for synthetic-data generation, manipulation and impersonation risks.

Stage 4 – Authenticity verification

Maintain provenance records, laboratory verification and digital audit trails.

Stage 5 – Human oversight

Require qualified human assessment for consequential medical and administrative decisions.

Stage 6 – Liability and remedies

Establish mechanisms for complaints, investigation, compensation and appropriate penalties.

Stage 7 – Continuous monitoring

Conduct independent audits, security reviews and periodic reassessment of AI models.

9. Major Legal Challenges

A. Synthetic Biological Identity

Traditional legal frameworks distinguish between authentic biological samples and fabricated documents.

Deepfake technology complicates this distinction because AI can create convincing representations of biological characteristics without obtaining the actual biological material.

The legal question is whether synthetic information should receive the same treatment as authentic biometric or medical information.

A sensible approach is to regulate both according to their risks, while distinguishing the authenticity and evidentiary status of each.

B. Medical Malpractice and Diagnostic Liability

Suppose a diagnostic AI system generates a fabricated cancer biomarker result.

A doctor relies on the report and recommends unnecessary treatment.

Possible legal questions include:

Whether the hospital followed appropriate clinical standards.

Whether the laboratory properly validated the result.

Whether the AI provider adequately disclosed limitations.

Whether the doctor exercised reasonable professional judgment.

Whether the fabricated information caused the injury.

Liability depends on evidence of breach, causation and applicable medical and consumer law.

C. Insurance Fraud

Synthetic biomarker reports could be used to obtain insurance benefits through fabricated medical conditions.

This creates risks involving:

False insurance claims.

Medical-document forgery.

Fraudulent policy applications.

Incorrect underwriting.

Discriminatory risk classification.

Insurance companies should use independent verification procedures rather than treating AI-generated medical records as automatically reliable.

D. Criminal Investigations

A manipulated biometric recording may be used to falsely associate an individual with a crime.

For example, an AI-generated voice recording may appear to show a suspect admitting to an offence.

Investigators should preserve original recordings, verify their source, examine metadata and obtain appropriate forensic expertise.

Courts should distinguish genuine forensic findings from unverified AI-generated conclusions.

E. Jurisdictional Conflicts

A deepfake biomarker may be generated in one country, hosted in another and distributed internationally.

This raises questions about:

Applicable privacy laws.

Cross-border data transfers.

Jurisdiction of courts.

Intermediary responsibility.

International cooperation.

Enforcement of removal orders.

A harmonised international framework would help address these problems.

10. Proposed Legal Tests Under the Doctrine

The following tests can be developed as a proposed judicial framework.

These are proposed analytical tests, not established statutory tests or binding judicial holdings.

11. Recommendations for Legal and Regulatory Reform

India could strengthen this area through the following reforms:

1. Specific synthetic biometric legislation

Introduce clear rules addressing unauthorised creation, alteration and distribution of synthetic biometric identifiers.

2. Mandatory AI provenance disclosure

Require appropriate identification or disclosure of AI-generated material, especially where it could be mistaken for genuine medical or identity evidence.

3. Biomarker verification standards

Establish independent technical and laboratory standards for validating AI-generated and AI-analysed biological information.

4. Protection against discriminatory use

Prevent unreliable synthetic medical or biometric information from being used as the basis for arbitrary employment, insurance or public-service decisions.

5. Platform accountability

Establish proportionate procedures for reporting, investigating and removing unlawful deepfake content.

6. Judicial forensic guidelines

Develop procedures for examining AI-manipulated electronic evidence, including access to original files, provenance information and independent forensic experts.

7. Compensation mechanisms

Provide effective remedies for individuals suffering financial, reputational, medical or privacy-related harm from unlawful synthetic biomarker manipulation.

12. Conclusion

The Deepfake Biomarker Governance Doctrine represents an important emerging area of biotechnology law, constitutional law, privacy law and artificial intelligence regulation.

Its central objective is to ensure that biological identity and biomarker information cannot be manipulated, fabricated or commercially exploited without appropriate legal accountability.

The judgments in Puttaswamy, Anil Kapoor, Patel v. Facebook, Titan Industries and Arjun Panditrao Khotkar provide important legal foundations for developing this framework.

However, these cases address different legal questions. None establishes a complete judicial doctrine specifically governing deepfake biomarkers.

The future development of this area requires a combination of:

Constitutional protection of identity and dignity.

Consent-based and lawful biological-data processing.

Scientific validation of synthetic biomarker information.

Algorithmic transparency and accountability.

Stronger electronic-evidence authentication.

Effective civil and criminal remedies.

International cooperation on synthetic biological identity.

Ultimately, the governing principle should be that technological ability to reproduce or manipulate a person's biological identity must not become an unrestricted legal authority to control, falsify or exploit that identity.

13. Important Case Law Reference List

Primary reading resources:

Anil Kapoor v. Simply Life India – Delhi High Court judgment

Patel v. Facebook – Ninth Circuit judgment

Clearview AI – UK Tribunal proceedings

AI, fabricated biometric information and evidentiary privacy risks

Academic note: This subject is suitable for advanced research in biotechnology law, AI governance, constitutional privacy, digital evidence and emerging technology regulation. The proposed doctrine should be distinguished from existing binding legal principles when used in a dissertation, research paper or legal argument.