S. Korean data privacy regulator confirms user data leak from DeepSeek to ByteDance

Authorities say Chinese AI application DeepSeek has indeed transferred user data to a third party amid data privacy concerns.

Moon Hye-ryeon has details.

South Korean data privacy regulators have confirmed that DeepSeek – the Chinese artificial intelligence startup facing controversy over data collection – has shared user data with TikTok's parent company, ByteDance.

The Personal Information Protection Commission said on Tuesday that although they were able to confirm the transmission of user data, it has yet to determine the exact nature and amount of data transferred.

The PIPC launched an independent investigation into DeepSeek's data collection and processing methods after requesting clarification on the matter from the firm last month, finding that DeepSeek's privacy policy fell short of the requirements listed for service providers in the country's Personal Information Protection Act.

"Under South Korean law, transferring personal data overseas or moving it from one country to another requires a legal basis. In this case, while ByteDance does have a headquarters in the U.S., when the PIPC says that user data was sent to ByteDance, it means there was an international data transfer. So the concern is whether DeepSeek complied with South Korea's regulations on cross-border data transfers."

The firm acknowledged that it had not fully considered South Korean data protection laws when launching its global service, and took the recommendation of the PIPC to temporarily suspend services in South Korea while necessary modifications are made.

This means that no new users can download the app across any domestic app markets such as Apple's App Store and Google Play, but existing users can continue to use it for the time being as the PIPC considers further measures to protect existing users.

During the suspension period, the PIPC plans to continue its thorough review of DeepSeek's handling practices.

Legislative efforts are also underway to amend the Personal Information Protection Act to reflect AI innovation with this latest development – strengthening enforcement measures for foreign service providers.

Experts say that it will be necessary to consider other AI services for legislative changes not just DeepSeek.

"Clear discussions on what standards should apply to all the new AI systems that will come out in the future are needed. AI is only going to become more widespread, and for it to provide more personalized services, it's going to need access to more of our personal information."

The PIPC also plans to seek stronger international cooperation on AI-related data privacy regulations at the Global Privacy Assembly in Seoul this September.

Moon Hye-ryeon, Arirang News.