What are the data privacy issues plaguing Chinese AI DeepSeek in the EU?

Data authorities across Europe are investigating the data policy collection of DeepSeek, the Chinese artificial intelligence (AI) company taking the technology sector by storm. 

Information requests launched in Italy, Ireland, Belgium, the Netherlands, and France want to know whether the AI company’s collection of information breaches Europe’s General Data Protection Regulation (GDPR) by transferring personal data to China.

These concerns have already led to the app’s blocking in Italy while authorities there investigate what data is collected, for what purpose, where it’s being stored, and whether it has been used to train its latest AI model.  

The Chinese start-up launched its chatbot R1 in January, claiming the model is cheaper to operate and uses less energy than OpenAI’s ChatGPT.  

So, why is it causing Europe's data authorities so much angst?

What information does the app record?

DeepSeek says in its terms of use that it collects three types of information from users: directly provided data like names and email addresses, automatically collected information like an IP address, and some from other sources such as Apple or Google logins. 

The agreement states that some of that information is collected through the direct monitoring of interactions and usage across devices, and that the app decides when it will need to protect the safety and well-being of its community.

That information can be stored "for as long as possible," and used for various purposes.

Any of the information provided can be sent to third parties, such as advertisers, analytics companies, law enforcement, public authorities, and copyright holders. 

This is not the only app to record these types of data; OpenAI's ChatGPT and Anthropic’s Claude do as well. Both apps, like DeepSeek, have faced criticism for their data privacy policies in the EU. 

GDPR gives Europeans some control over their data, like the right to erase or stop its processing. 

According to David Erdos, co-director of the Centre for Intellectual Property and Information Law at the University of Cambridge, DeepSeek has not guaranteed those rights would be met for EU app users. 

"We don’t have any provision of essentially equivalent or adequate data protection," Erdos said. 

Where is the information stored?

Much of the concern about the app stems from the fact that DeepSeek stores information on Chinese servers. 

DeepSeek says it maintains "commercially reasonable technical, administrative and physical security measures," to protect the data hosted in China and, when necessary, transfers user data by local laws. 

“There isn’t even… a legal provision given to why the data is fine to be stored in China and leaving the EU, it’s just asserted that that is where the data is,” Erdos said. “That itself would be a serious violation of the law”. 

A 2022 legal study paper from the European Data Protection Board (EDPB) found that the basis for Chinese privacy law is that "community stability should prevail over the needs of individual persons". 

The EDPB continued that "numerous exceptions" to personal data protection are made for the sake of national security or criminal investigations. The EDPB also doesn't know whether the data of foreign citizens is treated in the same way. 

According to a 2024 cybercrime index, China is also one of the world’s most prone to cyber security attacks. 

A recent analysis from technology company Cisco found that DeepSeek was unable to block any jailbreak cybersecurity attacks, unlike other models that can at least partially block these attacks. 

"DeepSeek R1 lacks robust guardrails, making it highly susceptible to algorithmic jailbreaking and potential misuse," their analysis reads. 

If users still want to use the app, Erdos said they should be cautious of disclosing any personal information, including anything "that would be of an intimate nature". 

"People have got to make their judgement as to whether they’re engaging with the service [while] it isn’t necessarily giving people the rights which they would expect," Erdos said. 

Euronews Next reached out to DeepSeek for a reaction to the data privacy investigations and for an explanation of how it holds onto data but did not receive an immediate reply.