A day after Italy’s data protection authority opened an investigation into DeepSeek and requested that the company send over information, the app disappeared from both Google and Apple’s app stores. Garante has since said that it has issued an order to DeepSeek to keep the app out of the country until privacy concerns are addressed, in a situation similar to what happened with ChatGPT nearly two years ago.
DeepSeek return to Italian app stores hinges on demonstrating sufficient protection of user data
The app was first withdrawn from Italy’s app stores on January 29. At the time, it appears that DeepSeek voluntarily pulled it after receiving the Garante’s request for information about transfer and storage of user data (which it was given 20 days to respond to). However, by January 31 the data protection authority had announced that the app was formally blocked for failure to provide sufficient information in response to the request.
Both the Italian data protection authority and the Irish Data Protection Commission have opened investigations into DeepSeek’s use of user data. The AI chat assistant rocketed to the top of the download lists of app stores over the month of January, and has at this point still been available to the public for less than one month. In just a few weeks it sent shockwaves through the generative AI world with its capability, prompting serious re-evaluation of investments in other similar projects.
While the capability was quick to impress, the big question hanging over DeepSeek is safety. It is based in Hangzhou and appears to process all of its user data there, raising natural concerns about adequacy of privacy under EU laws. The data protection agencies each represent their own nation at this point but are asking questions that are applicable throughout the EU under the terms of the GDPR: what personal data is collected, how it is collected, and whether the purpose and legal basis for this collection is considered sufficient under the regulation’s terms. The company was also asked to confirm that it stores and processes user data in China, and that it can demonstrate that it has measures in place to counter potential bias or attempts at election interference.
As it did when it eventually suspended ChatGPT in April 2023, the Italian data protection authority has also made child data protection a central focus of its probe. That seemed to be the key that caused ChatGPT to become unavailable for a time, as it was forced to add a new screening process and assurances to return to app stores in Italy. Charges of algorithm-based election interference are something that TikTok has been battling with, as the European Commission opened proceedings against the app in mid-December amidst accusations that it facilitated Russian meddling in Romania’s recent elections.
The disappearance of DeepSeek from the app stores did not appear to impact prior installations, as users reported the app continued to function. Its web-based service is also reported as continuing to work within the country. A spokesperson for the data protection authority said that DeepSeek was formally blocked after the company refused to cooperate and claimed that local regulators had no right to make demands for information.
More EU data protection authority investigations likely to come
While the situation is reminiscent of what happened nearly two years ago with ChatGPT, DeepSeek appears to be taking a much more defiant posture. The timing may not be opportune for the company given that GDPR complaints about data transfers to China are now coming into focus, with privacy crusader Max Schrems and his group noyb filing a battery of them last month. DeepSeek was not among the targeted companies, but it was also not even on the world’s radar until the second week of January.
If the company continues to take a defiant posture with data protection authorities, it may indicate that it is simply conceding Europe as a market and will not make a real attempt to comply. The company appears to at minimum be very supportive of Chinese government aims, with researchers noting that politically sensitive questions in that part of the world are either met with refusal to respond or established CCP talking points. One of the company’s big selling points is the ability to install and run its R1 model locally on phones and computers while retaining useful results without needing app stores as a middleman, something it may be banking on outside of China going forward.
Other regional data protection authorities that appear to be at least discussing a formal investigation into DeepSeek at this point include those of France, Germany, Belgium, Luxembourg and Cypriot. The Dutch authority has yet to comment on any plans but has issued a warning to its citizens about the potential safety issues of using the app.
