EDPB: ‘DeepSeek may expect more regulatory sanctions from DPAs’

Chinese artificial intelligence (AI) startup DeepSeek may face more actions from data protection authorities (DPAs) from EU member states.

According to the European Data Protection Board (EDPB), Europe’s privacy supervisor agency, privacy regulators from several European countries have raised concerns about how DeepSeek handles users’ personal information.

During last Tuesday’s plenary meeting, members of the EDPB voiced their concerns about DeepSeek. “Several DPAs have already started actions vis-a-vis DeepSeek and there may be further actions in the future,” a spokesperson for the EDPB said in an email after the meeting, press agency Reuters says.

In April 2023, the EDPB founded an AI taskforce to foster cooperation and exchange information on enforcement related to AI. The taskforce originally focused on OpenAI’s ChatGPT, but due to privacy concerns DeepSeek was recently added.

The EDPB spokesperson confirmed that the European privacy supervisor will set up a quick response team to effectively handle urgent and sensitive matters in the future.

The Garante per la Protezione dei Dati Personali (GPDP), Italy’s privacy regulator, was the first DPA to ban DeepSeek in order to protect users’ data. Countries like Australia, Taiwan and South Korea did the same.

DPAs from Belgium, France, Ireland, Luxemburg and the Netherlands have launched an investigation into DeepSeek’s privacy practices and are warning citizens to be cautious when it comes to sharing sensitive data to the Chinese AI chatbot.

Earlier this week, South Korea’s National Intelligence Service (NIS) accused DeepSeek of ‘excessively’ collecting personal data to train its AI chatbot.

“Unlike other generative AI services, it collects keyboard input patterns that can identify individuals, and includes the ability to communicate with Chinese company servers so that chat histories can be transmitted,” South Korea’s chief intelligence agency said in a statement.

In addition, users can’t object to the use of their data as learning input. Furthermore, because retention periods aren’t specified, users’ personal information is permanently being shared with advertisers. And because all data is being stored on servers in China, all this information is accessible to the Chinese government.