Reinterpreting the right to be forgotten: a doctrinal and feminist analysis of article 17 GDPR in cases of non-consensual deepfake pornography

Abstract

Non-consensual deepfake pornography has become one of the fastest-growing forms of image based sexual abuse and the people it targets are overwhelmingly women. It causes lasting psychological and reputational harm and strikes directly at human dignity, yet the existing legal response remains fragmentary. Criminal law tends to intervene only once the harm is done and varies considerably between Member States, while the available civil routes such as defamation, copyright, image rights and harassment, each reach only part of the injury. This thesis asks whether the General Data Protection Regulation and specifically the right to be forgotten from Article 17, can offer victims a more effective remedy than these alternatives. Two doctrinal obstacles stand in the way. The first concerns whether fabricated imagery of an identifiable individual qualifies as personal data and potentially as special-category data under Article 9. Drawing on the case law of the Court of Justice, the thesis argues that the question should turn on the effect of the processing on the data subject rather than on the authenticity of the image. The second obstacle lies in the balancing exercise under Article 17(3)(a), which presumptively treats synthetic intimate imagery as protected expression. Through a feminist reading of that framework, the thesis shows that the presumption is far from neutral and works to the systematic disadvantage of victims. Combining doctrinal analysis with feminist legal theory and grounding its argument in Articles 1, 3, 7 and 8 of the Charter of Fundamental Rights together with the substantive-equality guarantee in Article 23, the thesis proposes a constitutionally consistent reinterpretation of Article 17. It acknowledges the limits of this approach and positions the right to erasure as one component of an integrated European response, working alongside the AI Act, the Digital Services Act and Member State criminal law.