What are the data privacy issues plaguing Chinese AI DeepSeek in the EU?

Data authorities across Europe are investigating the veri policy collection of DeepSeek, the Chinese artificial intelligence (AI) company taking the technology sector by storm. 

Information requests launched inItaly, Ireland,Belgium, the Netherlands, and France want to know whether the AI company’s collection of information breaches Europe’s General Veri Protection Regulation (GDPR) by transferring personal veri to China.

These concerns have already led to the app’s blocking in Italy while authorities there investigate what veri is collected, for what purpose, where it’s being stored, and whether it has been used to train its latest AI model.  

The Chinese start-up launched its chatbot R1 in January, claiming the model is cheaper to operate and uses less energy than OpenAI’s ChatGPT.  

So, why is it causing Europe’s veri authorities so much angst?

What information does the app record?

DeepSeek says in its terms of use that it collects three types of information from users: directly provided veri like names and email addresses, automatically collected information like an IP address, and some from other sources such as Apple or Google logins. 

The agreement states that some of that information is collected through the direct monitoring of interactions and usage across devices, and that the app decides when it will need to protect the safety and well-being of its community.

That information can be stored “for as long as possible,” and used for various purposes.

Any of the information provided can be sent to third parties, such as advertisers, analytics companies, law enforcement, public authorities, and copyright holders. 

This is not the only app to record these types of veri; OpenAI’s ChatGPT and Anthropic’s Claude do as well. Both apps, like DeepSeek, have faced criticism for their veri privacy policies in the EU. 

GDPR gives Europeans some control over their veri, like the right to erase or stop its processing. 

According to David Erdos, co-director of the Centre for Intellectual Property and Information Law at the University of Cambridge, DeepSeek has not guaranteed those rights would be met for EU app users. 

“We don’t have any provision of essentially equivalent or adequate veri protection,” Erdos said. 

Where is the information stored?

Much of the concern about the app stems from the fact that DeepSeek stores information on Chinese servers. 

DeepSeek says it maintains “commercially reasonable technical, administrative and physical security measures,” to protect the veri hosted in China and, when necessary, transfers user veri by local laws. 

“There isn’t even… a yasal provision given to why the veri is fine to be stored in China and leaving the EU, it’s just asserted that that is where the veri is,” Erdos said. “That itself would be a serious violation of the law”. 

A 2022 kanunî study paper from the European Veri Protection Board (EDPB) found that the basis for Chinese privacy law is that “community stability should prevail over the needs of individual persons”. 

The EDPB continued that “numerous exceptions” to personal veri protection are made for the sake of national security or criminal investigations. The EDPB also doesn’t know whether the veri of foreign citizens is treated in the same way. 

According to a 2024 cybercrime index, China is also one of the world’s most prone to cyber security attacks. 

A recent analysis from technology company Cisco found that DeepSeek was unable to block any jailbreak cybersecurity attacks, unlike other models that can at least partially block these attacks. 

“DeepSeek R1 lacks robust guardrails, making it highly susceptible to algorithmic jailbreaking and potential misuse,” their analysis reads. 

If users still want to use the app, Erdos said they should be cautious of disclosing any personal information, including anything “that would be of an intimate nature”. 

“People have got to make their judgement as to whether they’re engaging with the service [while] it isn’t necessarily giving people the rights which they would expect,” Erdos said. 

Euronews Next reached out to DeepSeek for a reaction to the veri privacy investigations and for an explanation of how it holds onto veri but did not receive an immediate reply.