The jury is still out on whether the Chinese AI upstart DeepSeek is a game changer or possibly part of an elaborate plan by its hedge fund parent company to short Nvidia and other tech stocks. Whichever it might be (maybe both?), DeepSeek and its large language model has made some major waves. Now, it’s catching the eye of data protection watchdogs.
In what appears to be the first major move from one such watchdog since DeepSeek went positively viral in recent days, Euroconsumers, a coalition of consumer groups in Europe, has with the Italian Data Protection Authority filed a complaint related to how DeepSeek handles personal data in relation to GDPR, the data protection regulatory framework in Europe.
The Italian DPA confirmed today that it subsequently wrote to DeepSeek with a request for information. “A rischio i dati di milioni di persone in Italia,” it notes. (“The data of millions of Italians is at risk.”) DeepSeek has 20 days to respond.
One key detail about DeepSeek that many noticed is the service is made and operates out of China. Per its privacy policy, this includes the information and data that DeepSeek collects and stores, which is also housed in its home country.
DeepSeek also briefly notes in its policy that when it transfers data to China from the country where DeepSeek is being used, it does so “in accordance with the requirements of applicable data protection laws.”
But Euroconsumers — the organization that brought a successful case against Grok last year over how it used data to train its AI — and the Italian DPA want more detail.
Addressing Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence, the Italian DPA said it wants to know what personal data is collected, from which sources, and for which purposes – including what information is used to train its AI system – along with what the legal basis is for processing. It also wants more details on those servers in China.
Further, it writes in its information request, it wants to know “in the event that personal data is collected through web scraping activities,” how users who are “registered and those not registered to the service have been or are informed about the processing of their data.”
The news outlet MLex notes that Euroconsumers also highlighted that there are no details regarding how DeepSeek protects or restricts minors on its services, from age verification to how it handles minors’ data.
(DeepSeek’s age policy notes that it is not intended for users under the age of 18, although it does not provide a way to enforce that. For those between the ages of 14 and 18, DeepSeek suggests these younger users read through the privacy policy with an adult.)
#data #millions #Italians #risk
