South Korea’s data protection watchdog said that DeepSeek transferred data to a Beijing-based ‘affiliate’ of ByteDance.
South Korea’s data protection authority said on April 24 that Chinese artificial intelligence (AI) startup DeepSeek had transferred user data to multiple companies in China and the United States without consent.
The Personal Information Protection Commission (PIPC) released the findings of its preliminary investigation into DeepSeek, whose AI service and new downloads on South Korea’s app stores were temporarily suspended on Feb. 15 due to non-compliance with the country’s privacy laws.
The PIPC stated that DeepSeek did not obtain user consent before transferring data abroad, nor did it disclose this practice in its processing policy. The company’s action violates South Korea’s regulations, which require companies operating in the country to obtain consent from their users before handing over their personal data to any third party.
The number of U.S. and Chinese companies to which DeepSeek allegedly transferred data remains unclear.
It stated that DeepSeek transferred information from user-entered AI prompts, as well as device, network, and app information, to the Chinese cloud service platform Beijing Volcano Engine Technology before being suspended from South Korea’s app stores in February.
The PIPC identified Beijing Volcano Engine Technology as an “affiliate” of TikTok’s parent company, ByteDance, but said that it is “a separate legal entity and has no relation to ByteDance.”
The Epoch Times has reached out to both DeepSeek and ByteDance for comment and did not receive a response by publication time.
DeepSeek told the regulatory body that it used the Chinese company’s cloud service to improve “security vulnerabilities” and user experience but eventually blocked the transfer of AI prompt data to the platform, according to the PIPC findings.
DeepSeek also has denied collecting personal information from users under the age of 14. However, the PIPC found that it lacked a procedure to verify a user’s age during sign-up. The Chinese startup has since created an age verification procedure in response to the security review.
The PIPC said it would issue a corrective recommendation for DeepSeek, which will require the company to establish legal grounds for transferring personal data overseas.
DeepSeek will also be required to immediately destroy user-entered AI prompt that it had already transferred to Beijing Volcano Engine Technology, and enhance its service transparency, the PIPC stated.
Both DeepSeek and TikTok are facing scrutiny over national security concerns tied to their Chinese ownership. TikTok is facing a U.S. federal ban that will take effect unless ByteDance, its Chinese parent company, sells the social media platform. Meanwhile, a number of countries, as well as several U.S. government agencies, have blocked DeepSeek from government devices.
The launch of DeepSeek in January, a free, open-source AI model, sparked global data privacy concerns. The app is controlled by Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence, according to its privacy policy webpage.
The company stated on its privacy policy webpage that user information may be disclosed to third parties if it believes that such disclosure is necessary “to comply with applicable law, legal process or government requests, as consistent with internationally recognized standards.”
Under Beijing’s counterespionage law, companies in China are required to hand over their user data if requested by Chinese Communist Party authorities.
Australia and Taiwan have banned the use of the DeepSeek AI app on government devices over data security concerns, and Italy’s Data Protection Authority blocked access to DeepSeek on data protection grounds.
U.S. lawmakers on Feb. 7 introduced legislation aimed at banning the use and download of the DeepSeek AI app from government devices. Texas has already banned both DeepSeek and TikTok from government devices.