DPAs launch investigations into DeepSeek

Privacy regulators from Belgium, France, Italy, the Netherlands, and South Korea have requested information from DeepSeek about what information the company collects and processes.

The dust still hasn’t settled since DeepSeek made its introduction two weeks ago. The China-based start-up claims to have developed an AI chatbot that’s just as versatile as other, competing large language models (LLMs), but for a fraction of the costs.

The launch of DeepSeek AI caused a lot of ruckus, especially with privacy experts and data protection authorities (DPAs).

Italy’s Garante per la Protezione dei Dati Personali (GPDP) was the first privacy regulator to send a formal information request to DeepSeek. It wanted to know what personal data is collected, from what sources, and for what purposes.

In addition, the GPDP asked the AI tech company what type of information is used to train the AI chatbot and, in the event that personal data is collected by means of scraping, to clarify how registered users have been or are informed about the processing of their data.

DeepSeek responded, stating that it doesn’t operate in Italy and therefore the General Data Protection Regulation (GDPR) doesn’t apply to the company. The GPDP called this answer “entirely unsatisfactory”.

As of writing, citizens in Italy can no longer download DeepSeek’s app in the App Store or Google Play Store. The GPDP has imposed this ban to protect Italian users’ data. In addition, the DPA launched an investigation into the company.

The GPDP isn’t the only DPA that has launched an investigation into DeepSeek. We can add Belgium, France, the Netherlands, and South Korea to the list of countries that are interested in the Chinese tech company.

The Belgian consumer interest group Testaankoop filed a complaint against DeepSeek with the Belgium DPA for not taking European privacy laws seriously.

“We are pleased with the speed the DPA has responded to this case. The protection and control of our personal data is one of our most fundamental rights,” Laura Clays, spokesperson for Testaankoop, said in a statement to Belgian news outlet Gazet van Antwerpen.

The French privacy supervisor CNIL also confirmed it has started an inquiry into DeepSeek’s privacy practices.

The Dutch DPA voiced its concerns over DeepSeek’s privacy policy, recommending people ask themselves whether they really want to feed personal and other sensitive data to the Chinese chatbot.

“Transferring personal data of European citizens to countries outside the EU is only allowed under strict privacy conditions. It must be sufficiently guaranteed that people keep control of their personal data and know what happens to it. It remains unclear whether DeepSeek and other Chinese companies are compliant,” Aleid Wolfsen, Chairman of the Dutch DPA, told news outlet NOS.

Lastly, South Korea’s Personal Information Protection Commission acknowledged to press agency Reuters it will send a written request for information to the developers of DeepSeek.