Italian data protection watchdog goes after DeepSeek, seeks detailed info on personal data collection

The Italian Data Protection Authority, known as Garante, has turned its attention to DeepSeek, the Chinese AI chatbot that has quickly risen to prominence. Following its surge in popularity, especially in the US where it became the top-rated free app on the Apple App Store, Garante has raised concerns about potential risks to personal data privacy. The watchdog is seeking detailed information from the company about its data collection practices, particularly with regard to users in Italy.

In an official statement, Garante revealed that it has reached out to both DeepSeek’s offices in Hangzhou and Beijing. The inquiry focuses on understanding what personal data the chatbot collects, the purposes for which this data is used, and where it is stored. Of particular concern is whether the data is kept on servers located in China, which could pose a privacy risk under European Union data protection rules, particularly the General Data Protection Regulation (GDPR).

More from Tech

India, South Korea and more… The growing list of countries banning China’s DeepSeek DeepSeek's models 100% more susceptible to manipulation than US-made AI models, finds research

Concerns over data storage and privacy practices

DeepSeek’s privacy policy already acknowledges that personal information from users is transferred to and stored on secure servers within the People’s Republic of China. While the company claims it complies with relevant data protection laws, the Italian regulator is seeking further clarification on how personal data is handled. Garante is asking the company to specify what types of data are collected and how this information is processed, particularly in relation to AI training.

One of the key concerns is whether DeepSeek uses web scraping techniques to gather data from users, both registered and unregistered. Garante wants to know how users are informed about the processing of their data in such cases, in line with GDPR requirements for transparency and consent.

Allegations of data misuse

In addition to the concerns raised by Garante, there are reports suggesting that DeepSeek may have used data from OpenAI for its own AI model training. Bloomberg has reported that Microsoft and OpenAI are investigating whether DeepSeek improperly used data obtained from OpenAI’s API.

It is believed that a group of users accessed and extracted a significant amount of data last fall, which might have ended up being used by DeepSeek in its model. Microsoft’s security team is reportedly looking into a possible connection between the exfiltrated data and DeepSeek.

Garante’s request and global scrutiny

DeepSeek has 20 days to respond to Garante’s request for detailed information. This investigation is just the latest in a growing wave of scrutiny surrounding DeepSeek, with authorities in the US also examining the national security implications of the chatbot’s rapid rise. The outcome of these investigations could have significant implications for how Chinese AI companies operate in the global market, particularly in regions with stringent data privacy laws like Europe.

As DeepSeek continues to capture global attention, its data handling practices are coming under increasing scrutiny, with both European and US regulators taking a close look at its operations.

Editor’s Picks

1

DeepSeek's AI app is sending user data, chats, all uploaded files to servers in China  2

DeepSeek’s meteoric rise could be short-lived because of China’s data policies, history of lies