What is DeepSeek, and what happened?
Hangzhou-based tech company DeepSeek (an artificial intelligence company first launched in 2023) has recently launched models that have had a tremendous impact on the AI industry over the past week. Market performance of tech giants NVIDIA, Alphabet Inc, and Microsoft has dipped significantly in the wake of the launch that saw DeepSeek overtake OpenAI’s ChatGPT on the Apple Store and Google Play Store. Indeed, the release has been so impactful on chipmaker Nvidia, that the company has set the record for the largest single day loss by one company in market capitalisation history.
Why has it been so impactful?
In a paper published earlier this year, DeepSeek claimed that the training of DeepSeek-V3 cost less than $6 million, an astoundingly small number when compared to the figures in excess of $60 million it was purported to cost the Western giants to achieve the same. Furthermore, the models simply perform to a standard as sophisticated as many Western opponents while managing to function for a fraction of the running cost. In the USA, President Trump has called the launch of DeepSeek a ‘wake-up call’ for US tech companies – a sentiment that seems to be reflected in the ‘war rooms’ where Meta engineers are reported to be scrambling to catch up.
Recent developments
On Monday, DeepSeek reported that they were hit with a large-scale cyber attack, forcing the company to limit new registrations for the time being. Market leader OpenAI has responded by launching a version of ChatGPT tailored for use by US government departments and capable of handling sensitive non-public information. In the UK, the government recently announced plans to launch an AI tool package nicknamed ‘Humphrey’ to support workers in Whitehall.
DeepSeek and the GDPR
It may raise a red flag for many Western users of the Chinese model that the privacy policy announces, quite firmly, that personal information collected will be stored in servers located in the People’s Republic of China. Being a Chinese product, DeepSeek will be governed by China’s data law, chiefly the Personal Information Protection Law (PIPL). While imposing relatively strict requirements on the processing of data in China, there are certain key areas in which the GDPR and PIPL diverge which is perhaps evident in the terms of the privacy policy. There is mention of transfer out of users’ ‘home countries in accordance with the requirements of applicable data protection laws’ but there is no mention of International Data Transfer Agreements, Transfer Risk Assessments, Data Protection Impact Assessments or indeed the GDPR at all anywhere in the policy. That’s not to say that the policy falls into the realms of serious negligence, more that it is worded with a sufficiently broad approach including enough calculated key terms to be familiar enough to a GDPR professional.
Concerns of data usages, data storage and security have already been raised internationally. The Italian Data Protection Authority has previously had issues with the use of ChatGPT in Europe, and they’ve set their sights on DeepSeek too, questioning data sources, collection and lawful bases. Western users may also be somewhat alarmed by the prohibitions set out in the terms for content output, specifically around producing content that violates ‘business ethics’ or has ‘serious harmful impacts on society’; terms suggestive of policy driven by Chinese societal goals that may not always be harmonious with policies in much of the west.
Will doubts about DeepSeek be put to rest?
While DeepSeek AI certainly landed with a splash on the markets and does seem to cast some doubts on Western investment projects (e.g., America’s Stargate, UK Government’s Humphrey), questions remain about the level that users’ data is exposed to a variety of risks and dangers. Until such time that the models are able to satisfy Western users that they adhere to the GDPR and other accepted international framework, DeepSeek will likely continue to find themselves subject to critical examination.
