South Korea’s data protection authority, the Personal Information Protection Commission (PIPC), has determined that Chinese AI startup DeepSeek collected personal data from local users and transferred it overseas without their consent. This conclusion follows a thorough privacy and security review of the company’s operations. In February, DeepSeek removed its chatbot app from South Korean app stores after PIPC recommended it do so. The company agreed to cooperate with the authority’s concerns.
The PIPC’s findings revealed that DeepSeek had transferred user data to several firms in China and the U.S. without proper consent or notification to users. A specific example highlighted the transfer of AI prompts, device, network, and app information to a Chinese cloud service platform, Beijing Volcano Engine Technology Co., which is linked to TikTok’s parent company ByteDance. However, the PIPC clarified that while Beijing Volcano Engine Technology is affiliated with ByteDance, it is a separate legal entity with no direct connection to ByteDance itself.
DeepSeek stated that it used the platform’s services to enhance its app’s security and user experience, but after the findings were made, it ceased transferring AI prompt data on April 10. The company has not yet responded to inquiries about the matter.
DeepSeek, which gained international attention in January with its R1 reasoning model, has faced growing concerns about data security and privacy, especially due to China’s strict regulations requiring domestic companies to share data with the government. Experts have raised alarms over the app’s potential vulnerabilities and its privacy policies, which have prompted several governments to take action. Reports indicate that some South Korean government agencies prohibited their employees from using the app, with similar bans also occurring in Taiwan, Australia, and the U.S.
In response, the PIPC issued a corrective recommendation to DeepSeek, demanding that the company destroy the AI prompt data transferred to Beijing Volcano Engine Technology and establish legal frameworks for transferring personal data abroad. The PIPC also signaled that DeepSeek could return to South Korean app stores once it updates its practices to comply with local data protection laws.
READ MORE: