"Personal Data 'Entirely' Collected by DeepSeek Could Be Extracted by Chinese Government"

DeepSeek Blocked ①
China's 'Data Security Law' and 'National Intelligence Law' Allow Access to Personal Information
Korea and US Prioritize 'Information Protection' vs. China Mandates 'Information Provision for National Security'

The Chinese government is reported to have legal grounds to access personal information collected by China's AI model DeepSeek. DeepSeek's terms of service state that personal information left by subscribers can be stored on servers within China, and it is legally permissible for the Chinese government to utilize this data.

An official from the Personal Information Protection Commission (PIPC) said in a phone interview with Asia Economy on the 18th, "There is greater concern because the personal information collected by DeepSeek is stored on Chinese systems, not in Korea," adding, "Chinese law includes provisions requiring the provision of data stored on domestic systems upon request by national authorities."

The relevant regulations are China's 'Data Security Law' and 'National Intelligence Law.' These laws grant the government legal authority to access data stored on domestic servers at any time for national security reasons. Due to these laws, China's Personal Information Protection Law (PIPL), enacted in 2021 and considered one of the strictest privacy laws globally, comparable to the European GDPR, is not functioning effectively. The weekly number of users of the DeepSeek application in Korea reached 1.21 million as of the end of January. Given that nearly two weeks have passed since the count, even more personal information has come under the jurisdiction of the Chinese government.

Professor Choi Jae-sik of KAIST AI Graduate School explained, "In China, unlike Korea and the United States, the government's safety is considered far more important than individual human rights, so there is a greater possibility that personal information is not adequately protected."

The transfer of user information to domestic servers is also the case with American big tech companies such as ChatGPT (OpenAI) and Gemini (Google). However, these services perform 'tokenization' to identify only the necessary information, whereas DeepSeek collects information 'in its entirety,' which is a key difference.

Experts evaluate that China's personal information protection system shows significant differences from that of the United States. The U.S. has strictly limited government and public institutions' access to private information. Professor Choi Kyung-jin of Gachon University Law School (President of the Korean Artificial Intelligence Law Association) said, "The Privacy Act was enacted in 1974 to block access, and since no subordinate law can violate federal law, even states cannot access private information." He added, "Because of this legal framework, there is relatively less concern about personal information leakage when using generative AI services from American companies like OpenAI."

Korea's Personal Information Protection Act strictly limits the use of data that cannot be identified, such as so-called 'pseudonymized information,' if there is a possibility of identifying the individual. It can only be used for specific purposes such as statistics, research, or public interest record preservation. Attempts to re-identify individuals are prohibited by law, and violations are subject to fines or criminal penalties.

DeepSeek attracted significant attention domestically and internationally for its low cost and high performance but also raised security concerns due to extensive personal information collection. On the 15th, new downloads were ultimately blocked in domestic app markets. According to app analysis services WiseApp and Retail, the number of DeepSeek app users in the fourth week of January was 1.21 million, ranking second among generative AI apps during the same period, following ChatGPT with 4.93 million users.