Section: Justice & right Author: V Reading Length: ~27 min Sources and further reading: 22 items Topics: personality rights, likeness, identity, DSA, GDPR, criminal law, platforms SEO / Working Title: What to do if someone misuses your photo or identity?
What to do if someone misuses your photo or identity? The question sounds simple until we notice that we are not comparing a single form. Reporting to the platform is not a court order. A criminal complaint is not a preliminary measure. A complaint to ÚOOÚ is not a claim for the protection of personality. And ČTÚ, as the coordinator of digital services, is not a cleaning service. The article is therefore not looking for a delete button. It looks for which mode can carry what, when it makes sense to run concurrently and which promisedeletion by morning is just a dangerous shortcut.
1. A fake profile with your photo is not one form
A woman finds a fake profile with her photo. It's not a caricature or an old party photo together. The profile appears on her behalf, adds foreign sentences, and sends messages to people who know her. A friend says: report it to the platform. The lawyer says: secure evidence, call for removal, and possibly a lawsuit under the Civil Code. The policeman says: come and file a report if there are signs of a crime. The person from compliance asks if it is processingpersonal data by the administrator. The ČTÚ website states that the digital services coordinator does not have the authority to order the removal of content [12].
At first glance, this is a single deletion. In fact, each describes a different problem. A friend talks about reporting illegal content under platform rules and DSA. The lawyer talks about likeness, privacy, refraining from intervention, removal of consequence and satisfaction. The police are talking about the facts. ÚOOÚ talks about the administrator, processing and rights under the GDPR. ČTÚ talks about the procedural obligations of digital service providers.
Therefore, they can all be partly right and the common plan still fail. The bad plan is: fill out one form, delete the evidence, wait for the office and promise the family that everything will be over by morning. A better plan begins more boringly. URL, date, screenshot, account identification, exact electronic location. Without it, the announcement can be weak just when it needs to be specific [14].
Reporting, criminal complaint and prosecution are three different regimes. None of them is an instant delete button.
— Jiný Kontext
2. The effigy has at least six layers
When we say "they misused my photo" it sounds like one act. But law and platforms see several layers. Each of them changes the question, the evidence, and the expected outcome.
- Object: likeness, voice, name, fake profile, intimate material or manipulated material.
- Channel: social network, advertisement, web, messenger, email or storage.
- Civil regime: permission, withdrawal of permission, refraining from intervention, removal of consequence, satisfaction and compensation.
- Criminal regime: depending on the features of the case, it may be § 191a, § 181, § 184, § 175, § 209 or another factual matter.
- Platform mode: notices, reasons for decisions, internal appeals and out-of-court dispute resolution under the DSA.
- Supervisory mode: ÚOOÚ for the processing of personal data, ČTÚ for the procedural obligations of providers in the Czech Republic, the European Commission for very large online platforms.
This layering is not official pedantry. It determines what you can ask for and from whom. The court can deal with a personal claim under the Civil Code. The police can investigate a crime. A platform must have a mechanism to report illegal content, but its decision is not a judgment. ČTÚ can solve the obligations of the provider, not replace the court in the assessment of each photograph.
"Identity abuse" therefore obscures the distinction between the three situations. Someone posted someone else's photo without consent. Someone has created an account that impersonates a specific person. Someone created an intimate manipulated material. In common parlance, it's one blow. In law, there are several paths that sometimes meet and sometimes cross.
3. The best channel is the one whose failure does not promise to be deleted by morning
With a misused photo, one naturally wants speed. But the fastest sentence is often the worst legal advice: "They'll report it somewhere and delete it." Sometimes the platform strikes quickly. Sometimes not. Sometimes they delete one account and a copy lives on. Sometimes a precautionary measure is needed. Sometimes a criminal record. And sometimes it turns out that the supposed erasure authority has no such authority at all.
| A kind of failure | What does he look like? | How to test | What will limit the damage |
|---|---|---|---|
| Bad channel | Complaint to ÚOOÚ about random sharing between people | Is there a manager, or a personal and haphazard operation? | Civil Claim and Court; ÚOOÚ only for processing |
| 24 hour promise | Waiting for ČTÚ or the platform to delete everything by morning | ČTÚ does not order erasure; DSA Article 20 is not an erasure period | Traces, Concurrency, Precaution |
| Confusion of deeds | Every deepfake as § 191a, or every profile as mere slander | Signs of specific facts, not a headline in an email | PČR notification with a description, not with a certain qualification |
| Notification without URL | The platform cannot find the content | Does the notice have an exact electronic location? | URL, screenshot, date before submission |
| Deleting one copy | One page disappears, the material remains in the news | Looking for mirroring and re-uploading? | Expect repeated steps, not a single form |
A well-chosen channel is not the one that promises the most. It is a channel whose failure is understood in advance. When the platform does not respond, you have a clue for further action. When criminal law does not cover a particular situation, there may still be a civil invasion of form or privacy. When ÚOOÚ says that it is not an administrator, it does not mean that the intervention did not happen. It means you were in a different mode.
4. Personal law is not GDPR
The Civil Code protects a person's personality, appearance, privacy and manifestations of a personal nature. It is based on the permission rule for the image and image recording. Capturing the likeness of a person in such a way that it is possible to determine their identity based on the image is generally only possible with permission. Likewise, permission is required to extend the image [1].
This does not mean that every photo on the Internet is illegal. The Civil Code recognises statutory licenses. The image may be used under certain conditions to exercise or protect other rights, for an official purpose, reasonably for a scientific or artistic purpose, and for news. But these exemptions are not a blank check. § 90 reminds us of proportionality: the legal reason must not be used disproportionately in conflict with the legitimate interests of a person [1].
GDPR solves a different matter. It deals with the processing of personal data by the controller or processor. A photo can be personal information. But this does not mean that every conflict about a photograph is automatically a complaint to the ÚOOÚ. Random sharing between people, purely personal operations, or a one-off likeness dispute may not fit into the same procedural framework as a customer database, company profile, camera system, or systematic disclosure.
The practical difference is simple. Civil law asks if personality has been affected and what the other party is to do or compensate. The GDPR asks who the controller is, what legal title they have, how they fulfill the rights of the data subject and who supervises. It's not the same thing. It's the next floor.
5. A complaint to the ÚOOÚ is not a claim for the protection of personality
ÚOOÚ is the supervisory authority for the protection of personal data. It can be approached with a complaint against the administrator or processor if a person believes that the processing of their data has violated the GDPR [8]. This is an important path. However, it is not a legal action for the protection of personality and the office does not impose an apology or a painful one.
The ÚOOÚ annual report for the year 2025 lists 3,854 submissions, of which 2,514 were complaints and 1,340 initiatives. The report indicates a year-on-year increase of 68%. The same document lists 392 reports of personal data breaches [10]. These numbers do not tell how many people in the Czech Republic found a fake profile with their photo. It measures the broad agenda of the supervisory authority, which includes, among others, consents, camera systems, healthcare, leaks at administrators and other areas.
The GDPR gives the data subject the right to lodge a complaint and Article 78 talks about the right to judicial protection if the supervisory authority does not handle the complaint or the subject does not inform about the progress or result within three months [7]. Three months is not the time limit in which the platform must delete a foreign profile. It is a procedural rule for supervisory authority communication.
Before the complaint to ÚOOÚ
The first test is: who is the administrator? Is it a company page, a database, an advertising system or a systematic publication? Or is it a random personal intervention that should be dealt with more civilly and platform-wise? The second test is: can you describe the processing, the controller and the violated right? Third: you don't want something after the ÚOOÚ that can only be ordered by the court.
6. A criminal complaint is not a private law ban on dissemination
A criminal complaint has a different purpose than a lawsuit. The police and the public prosecutor's office deal with whether there are signs of a crime. A civil court can deal with whether someone should refrain from intervention, remove the consequence, apologize or compensate for the damage. These paths can complement each other. They don't replace each other.
This is practically important for things that burn. A criminal complaint alone may not quickly stop the spread. A civil motion for a preliminary injunction may seek prohibition or removal, but requires a different argument and a different process. A platform notice may remove the availability of content on a particular service, but it is not a judgment on the responsibility of the offender.
It is not the task of the injured party to write a perfect legal qualification in the title of the submission. Its job is to describe what happened, when, where, who is affected, what content was published, what was said, and what harm is threatened or caused. Legal qualifications then belong to law enforcement authorities. An overconfident headline can do harm if it obscures other features of the matter.
Misuse of a photograph may involve defamation, extortion, fraud or more recent tort and pornographic provisions in various situations [3][4][5]. It does not follow that every photo copied is a crime. It follows that criminal law is an avenue for certain serious cases, not a one-size-fits-all button.
7. Section 191a is not Section 181 paragraph 2
As of January 1, 2026, the Czech Criminal Code explicitly provides for new situations regarding identity, likeness and counterfeit works. Amendment No. 270/2025 Coll. inserted, among other things, § 191a and amendment of § 181, paragraph 2 [6]. It's tempting to say: deepfake is the new crime. But that's too harsh.
Section 191a aims at the misuse of identity to produce pornography and its distribution without the consent of the depicted person. The base rate is up to two years in prison, in addition to alternatives, and qualified cases have a higher rate of one year to five years [5]. The essential thing is that it is a pornographic work and the consent of the depicted person. In the basic facts, it is not required to prove serious damage as a separate feature.
§ 181 paragraph 2 is different. It works with a tort using the likeness or other manifestation of a person's personal nature, but requires intent to cause serious harm. The basic rate for § 181 is up to two years [3]. It is the intent to cause serious harm that can be the difference between a criminal and a non-criminal case, even if civil interference with personality may remain.
As of September 2026, the annual statistics of prosecuted cases under these new provisions cannot be derived from this. There is no such public annual series in the file. So the exact sentence is not "X number of cases are increasing". It sounds like the legal framework has distinguished several types of counterfeit material and each has its own characteristics.
8. Section 180 is not every copied selfie
The Criminal Code also recognises unauthorized handling of personal data under Section 180 [2]. In the case of an abused photo, people often ask about it because the photo can be personal information. But § 180 is not a general punishment for every selfie copying. The provisions are aimed at specific situations, for example data collected in connection with the exercise of public authority or breach of confidentiality.
This does not mean that the copied photo is unprotected. It means that the protection may be elsewhere. On interference with the form and privacy in the Civil Code. In the case of defamation, if someone spreads a false statement capable of significantly endangering a person's reputation. In blackmail, if the visual material is used for coercion. For fraud, if the misuse of identity is used to lure money or access [4].
This is where it is dangerous to write your own legal diagnosis from the Internet. One case can have multiple layers. A fake profile can be an invasion of personality, a violation of platform rules, sometimes part of a fraudulent act, and sometimes a criminal matter of another nature. But without specific content, communication, intent, harm, and context, the mere sentence "they took my photo" cannot be turned into a ready-made factual matter.
A good submission therefore does not play legal bingo. He describes the facts, attaches the available clues and separates the certain from the supposed. It's not a weakness. It's precision.
9. DSA reporting is not a court order. ČTÚ does not order deletion
The DSA, or Digital Services Regulation, imposes a mechanism on hosting services to allow them to report illegal content. Article 16 describes notifications and measures, Article 17 reasons for decisions, Article 20 the internal complaint handling system and Article 21 out-of-court dispute resolution [11].
This is important infrastructure. But it doesn't mean that the user got the European "delete" button. The notification must be specific. In its materials, CTU emphasizes the essentials of notification, including the exact electronic location of the content [14]. If the platform decides, a justification should follow for some services. If the user does not agree, he can use an internal complaint. DSA also provides for non-judicial authorities.
The most common confusion concerns the ČTÚ. On the page for the digital services coordinator, the Czech Telecommunications Authority states that it does not have the authority to order the removal of content or to assess the illegality of specific content [12]. Therefore, a complaint to the CTU is not a request for the office to delete the photo. It may point to a procedural failure of the provider, for example, that the mechanism does not work or that the required justification is missing.
In addition, Article 20 sets a period of at least six months for filing an internal complaint against the platform's decision [11][13]. This is not the time frame within which the reported content should be removed. Whoever turns it into a promise of erasure is exchanging procedural law for result.
ČTÚ, as the coordinator of digital services, does not order content to be deleted. A process complaint is not a request to delete a photo.
— Jiný Kontext
10. The host has no general duty to supervise
Act No. 480/2004 Coll. about some services of the information society works with the responsibility of providers of information society services. When storing information at the user's request, the host's responsibility is linked, among other things, to knowledge of the illegal nature of the content or circumstances from which the illegality is obvious. § 6 also says that providers do not have a general obligation to monitor the content they transmit or store [15].
This does not mean that the hosting service is not supposed to do anything. It means that the law has long refused general oversight of all content in advance. The DSA follows this up with procedural rules for notification, justification, complaints and transparency. It's not a simple "the platform is always responsible for everything" or "the platform is never responsible for anything".
In its information on DSA, the Ministry of Education, Culture, Sports and Science mentions the sharing of private photos without consent as an example of illegal content [20]. This helps to understand why the announcement makes sense. But it doesn't add a public guarantee that specific content will disappear in a certain number of hours, nor does it address off-service copies.
The practical question for the injured party is therefore twofold. Can I report content to the platform so it can find and review it? And besides that, do I have a way for the person or entity that caused the intervention? Platform mode may be the fastest to limit availability. They may not be the most fully accountable.
11. Directive 2024/1385 is no longer a finished Czech crime
Directive (EU) 2024/1385 of the European Parliament and of the Council deals with combating violence against women and domestic violence. Article 5 calls for the criminalization of certain forms of non-consensual sharing of intimate or manipulated material, including material created or altered by technology. Recital 19 also talks about deepfake material [16][17].
It is an important European framework. However, it is not a sentence that can be copied into the Czech criminal report as a ready-made factual substance. The directive has a transposition deadline of June 14, 2027 [16]. The Czech Criminal Code has already modified some parts with an amendment effective from January 1, 2026. But the EU minimum and the Czech sections must not be identified without the text.
The difference is practical. The European text says what the member states have to ensure. The Czech Criminal Code states how law enforcement authorities assess a specific act in the Czech Republic. If these sentences are mixed up, it creates an appearance of certainty, which does not help the presentation.
The directive is therefore a support for a wider trend and for the interpretation of political commitment. It is not a substitute for the analysis of § 191a, § 181 paragraph 2 or other provisions in a specific matter.
12. Deletion on one platform is not deletion everywhere
Even if the platform removes the content, the problem may not end. The photo can be downloaded, forwarded, re-uploaded, archived, distributed in messages or embedded on another website. Re-uploading is not proof that the first step was pointless. It's an expected scenario for material that once got out of control.
This is precisely why it is dangerous to talk about "erasing the Internet". In practice, we often deal with restrictions on availability, removal of specific copies, refraining from further distribution, identification of the originator and compensation. Each goal needs a different tool. A platform notification can resolve a single link. Civil proceedings can target a person or an entity. Criminal proceedings can deal with serious conduct. ÚOOÚ can deal with the administrator and processing.
This also applies to evidence. If a person deletes everything they see so they don't have to look at it, they can weaken their ability to prove what was posted. A proof copy is not a distribution guide. It is a precaution against a future dispute. All that is needed to substantiate the claim: address, time, screen capture, account identification, communication with the platform and confirmation of submission.
No public line in the file says the median time Meta, Google or another platform in the Czech Republic deletes an abused likeness. So the exact advice cannot promise the number of hours. He can tell how not to lose tracks and how not to mix channels.
One more difference is important. Deleting content and prohibiting further action are not the same goals. The first looks at a specific copy: this link, this profile, this file. The second looks at the behaviour of the person or subject: do not continue, do not record again, do not address the surroundings, do not pretend to be injured. A platform can solve the first goal in its service without solving the second itself. The judicial path may aim at the second goal, but it may not immediately remove every existing onea copy out of reach of the defendant.
That's why a good record doesn't just say "deleted". It notes where the content was, when it was reported, how the platform responded, whether a new copy was created, and whether the same behaviour is repeated. Repetition is then not just another inconvenience. There may be evidence that this is not a random error, but an ongoing intervention that needs a stronger process response.
Likewise, it is good to separate the visible result from the legal result. Bystanders can see that the profile has disappeared. But the file needs to know if it disappeared after being reported, after a request, after an administrator intervened, or simply because the author moved it elsewhere. For humans, the first difference is psychologically smaller. It is essential for further progress.
13. Deepfaking intimate material is a legal title, not a detection contest
With intimately manipulated material, the debate often turns to whether it is possible to tell that the material is synthetic. This may be relevant to the evidence. However, that is not the heart of this legal question. This is not a contest of image detectors or voice forensics. These are form, consent, dissemination, injury and legal title.
The new § 191a explicitly aims at the misuse of identity to produce pornography and its distribution without the consent of the depicted person [5]. Section 181(2) works with a false work using the likeness or expression of a personal nature, if there is an intention to cause serious harm [3]. Directive 2024/1385 in turn shows the European framework for non-consensual intimate and manipulated material [16].
It does not follow that every manipulated image is the same act. It follows that the word deepfake alone is not enough. It decides what the material shows, whether it is pornographic or intimate, whether it was disseminated, to whom, with what consent, with what intention and what intervention was made.
The AI Act and the labeling of synthetic content does not address this issue like the deletion of another's photo. Labeling can be important for transparency. It does not by itself answer the question of whether specific material should be removed, whether harm has occurred or whether someone has committed a crime. These are different modes.
14. 21,137 acts in cyberspace are not the number of abused photos
The police of the Czech Republic reported a total of 21,137 registered acts in cyberspace for the year 2025 [18]. In the report on public order and internal security for the year 2025, the Ministry of the Interior reports 3,695 moral crimes and an increase of 8.8%. At the same time, it draws attention to the change of facts from January 1, 2025 [19].
These numbers are useful as context. It is not the number of abused adult photos or the number of deepfake pornography in the Czech Republic. Cyberspace encompasses many types of dealings. Moral crimes include a variety of acts, including rape, child pornography or sexual abuse. The unit is not a "fake profile with a photo".
It is with sensitive topics that the temptation arises to fill in the missing number with an estimate. That would be a mistake. The file expressly does not contain verified statistics of victims of deepfake pornography in the Czech Republic. It does not even include the annual public series of cases according to the new § 191a and § 181, paragraph 2 for the year 2026. Therefore, such a number is not used in the article.
Three mode tests
The civil test: is it form, privacy and distribution without permission, or is there a legal license within reasonable limits? Criminal test: are there signs of § 191a, § 181 paragraph 2, defamation, blackmail, fraud or other factual elements? Platform test: can you flag illegal content with exact location or just write that you don't like the account?
15. Concurrence of channels is not the order of magic
There is no single royal move in a good procedure. There is a parallel in it. First traces: URL, date, screenshot, account identification, message text, report confirmation. Then the platform: notification of illegal content with specific location and reason why the content is illegal. Then the civil law level: a call to refrain from intervention and removal of the consequence, possibly a proposal for a preliminary measure or a lawsuit according to Sections 81 to 90 of the Civil Code [1].
A criminal report makes sense if the situation bears the hallmarks of a crime. In the case of intimate pornographic material without consent, it may be § 191a. In the case of a false work with the form and intent of serious harm § 181, paragraph 2. In the case of coercion, false statements or monetary damages, other provisions may come into consideration [3][4][5].
ÚOOÚ belongs to the plan when it concerns the processing of personal data by an administrator or a processor. ČTÚ belongs to the plan when we deal with the procedural obligations of the provider according to the DSA, especially for services established in the Czech Republic. The European Commission has a role for very large online platforms. But none of these sentences mean that the office itself deletes someone else's profile.
What needs to be tested
Do you have the exact location of your content? Do you know if the other party is an admin, platform, private person or unknown account? Do you want the removal of specific content, prohibition of further distribution, compensation for damage, criminal response, or procedural control of the platform? The answer is determined by the channel. Not the other way around.
16. A documentable concurrence will tell more than one form
One form can help. However, one form rarely takes all the damage. Documentable concurrency means that every step leaves a trace and every destination has a corresponding path. Platform confirmation will show what was reported. The prompt will show what the victim requested. The criminal complaint will show how the facts were described. The motion to court will indicate what prohibition or removal is sought.
This is not a guide to waging war with an account. The goal is not to silence criticism or to abuse reporting against inconvenient content. The aim is to protect the form, identity and privacy where human rights are actually interfered with. Likewise, the goal is not to explain how to produce manipulated material or circumvent platform rules. The article describes defense channels and their limits.
A documentable procedure has another advantage: it prevents over-promising. If the platform doesn't respond, we know what's missing. If the authority is not competent, we know why. If a lawsuit requires more evidence, we know what evidence must have existed before the content disappeared from the screen.
So the best practical advice is not "click here". It's a sentence: don't lose track, don't confuse the regime and don't expect one actor to have authority he doesn't have.
Such a procedure also protects the other party from overshooting the claim. Not every nasty comment is identity theft. Not all uses of a photograph are license-free. Not every violation of platform rules is a crime. A precise distinction is therefore not a concession to the offender. It is a condition that the intervention is dealt with where it has a chance to stand. If it's a news photo in a reasonable context, the dispute will be different than a fake profile. Regarding the company profile,that uses an employee's portrait after withdrawing consent, the dispute will be different from an unknown account that spreads intimate manipulated material.
This is where the value of a short internal map shows itself. Column one: what is the content. Column two: where it is located. Column three: which mode is running. Column four: what result we expect from him. If a row is left blank, it is not a detail. It is where time is lost later.
17. The question is not how to delete it. It sounds like which mode takes which damage
An abused photo creates a legitimate need for a quick end. But Internet content does not have one switch and law does not have one form. Personal law deals with interference with a person. Criminal law deals with an act that society considers so serious that it responds to it with punishment. Platform mode addresses content availability at the provider and DSA procedures. Supervisory authorities deal with their sections, not everything at once.
It does not follow that the injured party should resign. It follows that he is to reject false simplicity. Those who promise immediate erasure often skip evidence, legal claims, and procedural limits. Anyone who sends everything to one office can waste time. Whoever names everything as a crime can miss the civil law path, which is more important for removing the consequence.
So the right question isn't: how do you force the internet to delete a photo? It reads: which of the three regimes are you currently running, what can the court order, what can the police investigate, what should the platform assess and why the DSA coordinator in the Czech Republic is not a delete button. Identity does not defend itself with one word "report". It defends itself by not allowing the three different regimes to merge into one promise.
Related texts in this series
- Deepfake: How to spot a fake video… — file detection vs. legal channel of deletion.
- Is the photo proof?
- How to find out if your password has been leaked… — another type of identity theft.