In the age of Artificial Intelligence, data is the new currency, and the protection of personal information is of paramount importance. In this regard, on Thursday, South Korea’s Personal Information Protection Commission (PIPC) alleged the Chinese AI startup, DeepSeek, for transferring unauthorized data and prompts without the user’s consent. The revelation comes after months of regulatory scrutiny following the chatbot’s January debut in the South Korean market. The commission official, Nam Seok, told the media
“Initially, DeepSeek transferred personal data to companies located in China and the United States without obtaining users’ consent or disclosing this in the privacy policy at the time the service was launched,”
User Data Transfer
According to the commission, during its initial launch phase, DeepSeek secretly transmitted personal data to several entities in China and the United States, bypassing the consent requirements mandated by South Korean data laws. The app was subsequently pulled from South Korea’s market in February after DeepSeek acknowledged lapses in adhering to local privacy standards.
Prompt’s Transfer
The commission also found that DeepSeek had shared user-inputted AI prompts, along with device, network, and app data, with Beijing Volcano Engine Technology, a move the company justified as an effort to “enhance user experience.” On this, Nam Seok said
“In particular, it was confirmed that DeepSeek transferred not only device, network, and app information, but also user inputs in AI prompts to Volcano Engine.”
DeepSeek later informed South Korean authorities that it had halted the transfer of AI prompt data from April 10.
In response to the findings, the PIPC issued a corrective recommendation ordering DeepSeek to immediately delete all previously transferred AI prompt content and to establish a legal basis for any future cross-border transfers of personal information.
While DeepSeek has yet to publicly comment, China’s Foreign Ministry maintained that the Chinese government does not, and will not, instruct companies to collect or store user data illegally.