Personal Information Commission Announces Results of DeepSeek Preliminary Inspection
No Option to Ask Users About Using Their Responses for AI Development
"Recommendation to Appoint a Domestic Representative... Thorough Monitoring Planned"
The South Korean government has imposed sanctions on the Chinese artificial intelligence (AI) service "DeepSeek" for excessively collecting personal information and transferring it overseas. The resumption of DeepSeek's service, which has temporarily suspended new downloads, is expected to be determined by the company itself after it raises its personal information protection standards to comply with domestic laws.
On the 23rd, the Personal Information Protection Commission (PIPC) held a plenary meeting and deliberated and resolved the results of a preliminary inspection of DeepSeek. Previously, after the launch of DeepSeek's service in January, concerns were raised about possible violations of personal information protection, prompting the PIPC to begin a preliminary inspection. Since February 15, new downloads in South Korea have been temporarily suspended.
Poor Information Protection... Even Prompt Inputs Transferred Overseas
According to the PIPC's inspection, DeepSeek transmitted not only device, network, and application (app) information but also the content users entered into AI prompts to "Volcano," the cloud platform of the Chinese IT company ByteDance.
In response, DeepSeek explained that it used the cloud service to improve security vulnerabilities, user interface (UI), and user experience (UX).
However, the PIPC pointed out that "transferring the content users enter into prompts is unnecessary," and DeepSeek reported that it has blocked new transfers of such data since March 10.
Despite launching in the Korean app market, DeepSeek disclosed its privacy policy only in Chinese and English, not in Korean.
DeepSeek failed to comply with requirements under South Korean law, such as procedures for destroying personal information, safety measures, and specifying the name and contact information of the person responsible for personal information protection. It also stated that it collected more information than necessary, such as key input patterns and rhythms.
Additionally, there was no function allowing users to opt out of having the content they entered into prompts used for AI development or training.
Furthermore, although DeepSeek claimed not to collect personal information from children under the age of 14, there was no procedure to verify whether a user was a child during the sign-up process.
Hasty Follow-up Measures... DeepSeek Cooperates with the PIPC
DeepSeek submitted a Korean-language privacy policy and jurisdictional provisions to the PIPC in March.
The company also clarified that it did not actually collect extensive information such as key input patterns and rhythms, which had been a point of concern. DeepSeek stated, "Key input patterns were listed at a time when the information to be collected had not yet been finalized during service preparation," and added, "No such data was actually collected, and the privacy policy has been revised to accurately reflect the items collected."
In addition, DeepSeek has introduced a function that allows users to refuse the use of their prompt input content for AI development or training. The company also agreed to comply with the protection measures recommended by the PIPC to major AI service providers last year.
Regarding the collection of children's personal information, DeepSeek belatedly established age verification procedures during the PIPC's inspection process.
Recommendations for Correction and Improvement... Must Report Results Within Two Months
The PIPC decided to recommend that DeepSeek: ▲establish a legal basis for overseas transfer of personal information; ▲immediately destroy user prompt input content that has been transferred to Volcano; and ▲ensure service transparency by disclosing the privacy policy in Korean.
The PIPC also recommended improvements such as: ▲complying with enhanced personal information protection measures; ▲verifying and destroying any collected children's personal information; ▲improving safety measures across all personal information processing systems; and ▲appointing a domestic representative.
The PIPC issues "correction recommendations" for clear legal violations, and "improvement recommendations" for areas where legal violations are unclear but improvements are necessary.
If DeepSeek accepts the correction recommendations within 10 days, it is considered to have received a corrective order. The company must report the results of its actions regarding the correction and improvement recommendations to the PIPC within 60 days. The PIPC plans to check DeepSeek's implementation status at least twice.
Nam Seok, Director General of the Investigation and Coordination Bureau at the PIPC, stated at a briefing held at the Government Complex Seoul on the 24th, "In this case, we required the appointment of a domestic representative," adding, "We will more thoroughly monitor compliance through the domestic representative."
He continued, "We are cooperating with international personal information supervisory organizations," and "We will work to ensure that personal information transferred overseas is protected through this cooperative system."
DeepSeek is expected to autonomously resume new downloads once it determines that its personal information protection measures comply with South Korean law. Nam stated, "If the company accepts and implements the correction recommendations, it should be able to make its own decision on resuming downloads."
He explained, "The suspension of new downloads was not due to any disposition by the PIPC, but rather DeepSeek itself recognized shortcomings in compliance with the law during the process of providing global services and voluntarily suspended new downloads in order to make improvements."
Nam added, "If DeepSeek accepts the correction and improvement recommendations, the level of personal information protection required by our law will be sufficiently ensured," and "We will continue to verify whether these measures are properly implemented."
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
