Just Five Days After PIPC's Inspection
"Processing Information in Compliance with the Personal Information Protection Act of Korea"
Provision Added Allowing Users to Refuse Personal Data Transfers
On April 28 (local time), DeepSeek, a generative artificial intelligence (AI) service from China, published its privacy policy in Korean on its official website. DeepSeek has become the subject of controversy after it was revealed that the company not only collected excessive amounts of personal data, but also transferred some of this data to China.
On this day, DeepSeek revised its privacy policy, releasing a Korean version and making certain changes to its personal information policy. This update came just five days after the Personal Information Protection Commission (PIPC) deliberated and resolved the "DeepSeek Preliminary Fact-Finding Results" at its 9th plenary meeting held on April 23.
According to the PIPC's inspection, DeepSeek was found to have transmitted not only device, network, and application (app) information, but also the content users entered into AI prompts, to "Volcano," a cloud platform operated by the Chinese IT company ByteDance. During this process, DeepSeek did not obtain user consent for overseas data transfers or disclose its privacy policy to users.
In response, the PIPC recommended that DeepSeek establish a legitimate legal basis for overseas data transfers, immediately delete prompt information, and publish its privacy policy in Korean, among other corrective actions.
In the newly revised privacy policy, DeepSeek introduced a separate annex for Korea and explicitly stated that it would process personal information in compliance with the Personal Information Protection Act of Korea. The company also specified that user data would be transferred to a total of four overseas entities: three companies in China and one in the United States. It further stated that users have the right to refuse the transfer of their personal information. DeepSeek also disclosed a contact email address for users to communicate their refusal to transfer personal data.
According to the PIPC, DeepSeek submitted its Korean-language privacy policy and relevant jurisdictional provisions to the commission last month.
However, the app download service, which had been temporarily suspended on app marketplaces such as Google Play Store and Apple App Store, has not yet resumed. After concerns about privacy violations were raised following the launch of DeepSeek's service in January, the PIPC initiated a preliminary inspection. Subsequently, DeepSeek accepted the PIPC's recommendation to suspend the service and temporarily halted new domestic downloads starting February 15.
The timing for the resumption of the DeepSeek app service has not yet been determined. It appears that DeepSeek will autonomously resume new downloads once it determines that its data protection measures are compliant with Korean law. At a briefing on April 24, Nam Seok, Director General of the Investigation and Mediation Bureau at the PIPC, stated, "If DeepSeek accepts and implements the corrective recommendations, it will be able to independently decide to resume app downloads."
Meanwhile, this is the third time DeepSeek has revised its terms of service or privacy policy for regions outside of China. Previously, DeepSeek added a privacy policy for European countries and, last month, released a Japanese-language version of its privacy policy.
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
