It remains uncertain whether the Chinese AI newcomer DeepSeek is a groundbreaking innovation or simply a piece of a complex strategy by its hedge fund parent to short Nvidia and other tech stocks.
The ongoing debate regarding the potential impact of the Chinese AI company DeepSeek remains unresolved, with opinions divided on whether it represents a significant innovation or is merely a strategic maneuver by its hedge fund parent to undermine Nvidia and other technology stocks. Regardless of the truth, whether one or both scenarios apply, DeepSeek and its advanced language model have certainly generated considerable attention, now attracting scrutiny from data protection authorities.
In what seems to be the first significant action taken by a regulatory body since DeepSeek gained widespread popularity, Euroconsumers—a coalition of consumer advocacy groups in Europe—has lodged a complaint with the Italian Data Protection Authority concerning DeepSeek’s management of personal data in relation to the General Data Protection Regulation (GDPR).
The Italian Data Protection Authority confirmed today that it has reached out to DeepSeek, requesting further information. The authority highlighted the potential risk to the data of millions of individuals in Italy. DeepSeek has been given a period of 20 days to provide a response.
A notable aspect of DeepSeek that has drawn attention is its operation from China. According to its privacy policy, the information and data collected by DeepSeek are stored within its home country. The policy also states that when data is transferred from the location where DeepSeek is utilized to China, it is done in compliance with relevant data protection laws.
However, Euroconsumers—previously successful in a case against Grok regarding its data usage for AI training—and the Italian Data Protection Authority are seeking additional clarification.
In its communication with Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence, the Italian Data Protection Authority has requested detailed information about the types of personal data collected, the sources of this data, and the purposes for which it is used, including specifics on the data utilized for training the AI system. Furthermore, the authority seeks clarification on the legal grounds for processing this data and additional information regarding the servers located in China.
Additionally, the information request specifies an interest in understanding how users, both registered and unregistered, have been informed about the processing of their data in cases where personal data is collected through web scraping activities.
According to the news outlet MLex, Euroconsumers has also pointed out the lack of information concerning how DeepSeek safeguards or limits access for minors on its platform, including age verification processes and the management of minors’ data.
DeepSeek’s age policy states that its services are not intended for individuals under 18 years of age, although it does not implement any mechanisms to enforce this restriction. For users aged 14 to 18, DeepSeek recommends that they review the privacy policy with an adult.
Consumer advocacy groups and the Italian regulatory authority are the first to take action against DeepSeek, though they may not be the last, and subsequent actions may not occur promptly.
Earlier today, DeepSeek was a significant topic during a press conference held by the European Commission. Thomas Regnier, the Commission Spokesperson for Tech Sovereignty, was questioned about potential concerns at the European level regarding DeepSeek in relation to security, privacy, and censorship. However, the primary message conveyed was that it is premature to comment on any investigations.
“The services provided in Europe will adhere to our regulations,” Regnier stated, emphasizing that the AI Act is applicable to all AI services operating within the region.
He refrained from commenting on whether DeepSeek complies with these regulations according to the EU’s assessment. When asked if the app’s censorship of politically sensitive topics in China violated free speech regulations in Europe and warranted an investigation, Regnier responded, “These are very early stages; I’m not discussing an investigation at this point. Our framework is robust enough to address any potential issues that may arise.”
We have reached out to DeepSeek regarding the complaint filed by the Italian Data Protection Authority and will provide updates as more information becomes available.
