Gov't confirms DeepSeek's unauthorized data transfer abroad

The DeepSeek logo and the Chinese flag are seen in this undated photo illustration. Reuters-Yonhap

The Chinese artificial intelligence (AI) company DeepSeek has been found to have unlawfully transferred Korean users' data to several companies in China and the U.S. during its operation, according to Korea's Personal Information Protection Commission (PIPC) Thursday.

It even sent what the users entered into prompts to a subsidiary of ByteDance, the parent company of the Chinese social media platform TikTok.

According to the commission, DeepSeek, which launched its service here on Jan. 15, transferred user data to four overseas companies — three in China and one in the U.S. — until new downloads of the app were suspended in Korea on Feb. 15 due to privacy concerns.

The collected and transmitted data includes information on Korean users' devices, networks and apps.

During the process, the Chinese AI company did not obtain consent from Korean users for the overseas transfer, nor did it disclose this information in its privacy policy. Both the Chinese and English versions of the policy also omitted key requirements mandated by personal data protection laws, such as procedures for data destruction, methods and safety measures.

Before the service suspension, about 50,000 people used the service per day on average, according to the PIPC.

In addition to the data, the content of the prompts entered by users to receive answers from the generative AI was also transferred to Volcano, a subsidiary of ByteDance, one of the three Chinese companies.

The DeepSeek logo is seen in this undated photo illustration. Reuters-Yonhap

However, during the suspension period and the PIPC's inspection, DeepSeek submitted a revised privacy policy for use in Korea, which now addresses the previously omitted legal issues related to the overseas transfer of data.

While DeepSeek confirmed that it transferred personal data to Volcano without user consent, it explained that the use of the ByteDance subsidiary's cloud services was intended for security improvements and to enhance the user interface and user experience.

The commission pointed out that transferring the prompts users entered into DeepSeek needs to be addressed. As a result, DeepSeek stopped transferring the information on April 10.

"Although Volcano is a subsidiary of ByteDance, it is a separate legal entity and not directly connected to ByteDance," an official at the PIPC said during a briefing in Seoul.

"DeepSeek clarified (to the PIPC) that the information processed and entrusted to Volcano is not used for marketing or any other purposes outside of service operation and improvement. They have committed to fully protecting personal data in compliance with legal requirements and proper procedures."

Like other AI companies, DeepSeek utilized publicly available data and user entries for AI learning and development. However, there was no "opt-out" feature that allows users to refuse the use of their input prompts for AI training and development, a flaw that was only addressed after being pointed out by the PIPC.

The PIPC recommended that DeepSeek immediately delete the prompt entries transferred to Volcano and enhance safety measures across its data processing systems, including appointing a domestic representative.

The PIPC did not specify when downloads of DeepSeek's app would be resumed in Korea.