Italian data privacy agency probes China's DeepSeek AI, as EU tests GDPR compliance

Euronews

29-01-2025

Italian data protection authority Garante has launched a compliance probe into the companies behind China's DeepSeek AI service, and the European Commission will check whether the service complies with its broader tech rules, according to spokespeople for the institutions.
Garante has launched its investigation into Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence, giving the companies 20 days to furnish details on how the AI chatbot complies with GDPR, the European data protection law.
The agency said it is particularly looking into what data is collected, for what purpose, where it's being stored and if it has been used to train the AI model.
Theodore Christakis, professor of data law at the University of Grenoble, told Euronews that it was clear that data was sent to China. Since the company operates in the EU, Christakis said that the company is obliged to wholly apply GDPR. "However, they don't even mention the GDPR in their privacy policy, which shows that there is a problem,' he added.
The probe was triggered after consumer advocacy groups Euroconsumers and Altroconsumo wrote to Garante questioning how data are is protected and stored in China and whether it could ever be accessed by the Chinese government.
Under EU law, personal data can only be transferred to a third country if that country is deemed to provide adequate levels of protection or if special agreements are in place. 'China could never get an adequacy decision because it's very clear that their surveillance system does not meet the European requirements,' Christakis told Euronews.
Chinese companies such as TikTok can only operate in Europe if they pledge to safeguard data according to EU guidelines. Usage of European data by those companies making this pledge has also raised concerns.
'The problem with this type of scenario is how can you enforce such a decision if somebody does not have a legal representative establishment in Europe? Even if they fine them, are they going to pay?' Christaki asked.
Irena Moozová, the deputy director-general of the European Commission's justice directorate, told Euronews that the executive is examining whether there may be breach of EU laws by DeepSeek. "We are committed to protect all the rights of the European citizens and the legislation in place," she said.
'This is the great thing in Europe, is that we have the AI Act, you can be reassured that the services offered here in the EU by providers will respect our rules,' said European Commission digital affairs spokesperson Thomas Regnier. However, he precised "these are very early stages. I'm not talking about an investigation yet."
'DeepSeek raises concerns about compliance with the EU AI Act, particularly regarding data protection and intellectual property,' Italian MEP Brando Benifei (S&D), told Euronews. Benifei, who steered the AI Act through the European Parliament, indicated that transparency about training data sources was essential to avoid violations, such as unauthorized scraping of personal data or copyrighted material.
'Europe must remain competitive while enforcing its human-centric, rights-based approach to AI, setting a global standard for ethical and transparent innovation,' he added.
What is DeepSeek AI and why is everybody talking about it?
DeepSeek's eponymous large language model (LLM) has stunned Silicon Valley by becoming one of the biggest competitors to US firm OpenAI's ChatGPT. The latest DeepSeek models, released this month, are said to be both extremely fast and low-cost.
The DeepSeek-R1, the last of the models developed with fewer chips, is already challenging the dominance of giant players such as OpenAI, Google, and Meta, and this week sent stocks in chipmaker Nvidia plunging on Monday.
' The race for AI is far from being over' and 'Europe is ready to take its place in this race,' European Commission digital affairs spokesperson Thomas Regnier said.