The DeepSeek dilemma: A nightmare for privacy

What is the DeepSeek buzz all about? 

China-based startup DeepSeek has turned the tide in the artificial intelligence (AI) wave by  releasing its own AI model. The buzz about DeepSeek’s latest AI model grew on the back of three key reasons:  

• Cost Effectiveness  
• Ability to function on reduced capability chips  
• Less energy usage  

The Chinese AI firm recently emerged as a fierce competitor to industry leaders like OpenAI, when  it launched a competitive model to ChatGPT, Google’s Gemini, and other leading AI-fueled  chatbots that it claimed was created at a fraction of the cost of others. The release, triggered an  industry panic and market shock in the US, as key shares in the tech sector dropped sharply. Nvidia saw more than $460 billion erased from its market capitalization, a drop Bloomberg  characterized as the biggest in US stock market history. 

The AI app soared up the Apple charts and rocked US stocks, this has potentially cast doubts on  the dominance of the US in the artificial intelligence (AI) space and the validity of the sky-high  valuations for companies like Nvidia Corp. Not just that, experts say it may also reflect in the effectiveness of Washington’s export controls targeting China’s advanced chip and AI capabilities.  DeepSeek like other AI models does not require advanced chips to power their training. It becomes crucial to understand its rise at a time when the US government has widened the scope of bans to  stop the chips from being exported to China and being used to train Chinese firms’ AI models.  

While current leaders like Nvidia have a strong foothold, the release of DeepSeek challenges the  Western notion that China’s AI technology is years behind its US counterparts. Washington’s trade  restrictions had kept the most cutting-edge chips out of China’s hands, but DeepSeek, built using  open-source technology has given a strong reminder that AI dominance cannot be taken for  granted. 

DeepSeek’s meteoric rise has been accompanied by various concerns among users and experts regarding data privacy, cybersecurity, disinformation, and more. Some of these concerns have been  fueled by the Chinese origins of the AI research lab while others have pointed to the open-source  nature of its AI technology. 

What does DeepSeek’s Privacy Policy say? 

Average users are more likely to access DeepSeek’s AI by downloading its app on iOS and Android  devices or using the web version. In its privacy policy, DeepSeek unequivocally states: “We store  the information we collect in secure servers located in the People’s Republic of China.” As per the  privacy policy, the user data collected by DeepSeek is broadly categorized into: 

• Information provided by the user: Text or audio inputs, prompts, uploaded files, feedback,  chat history, email address, phone number, date of birth, and username, etc. • Automatically collected information: Device model, operating system, IP address,  cookies, crash reports, keystroke patterns or rhythms, etc. 
• Information from other sources: If a user creates a DeepSeek account using Google or  Apple sign-on, it “may collect information from the service, such as access token.” It may  also collect user data such as mobile identifiers, hashed email addresses and phone  numbers, and cookie identifiers shared by advertisers. 
• “When you use our services, we may collect your text or audio inputs, promt, uploaded  files, feedback, chat history, or other content that you provide to our model and services.  We store the information we collect in secure servers located in the People’s Republic of  China, 
• It further states that DeepSeek’s corporate group can access the user data and will be shared  with law enforcement agencies, public authorities, and others in compliance with legal  obligations. 

Data Privacy Concerns  

DeepSeek’s data processing practices present several challenges under the Digital Personal Data  Protection Act. The extensive data collection, including personal data, raises concerns about data  minimization and excessive collection. Storing user data in servers located in China presents 

significant risks due to cross-border data transfer restrictions. Sharing data with the corporate  group and potentially with law enforcement agencies requires careful consideration of legal  grounds, transparency, and user rights. Furthermore, the use of algorithms raises concerns about  potential biases and the need for algorithmic accountability. Ensuring user rights, such as data  access, correction, and erasure, and implementing robust security measures are crucial for  compliance. DeepSeek AI as a Data Fiduciary, faces compliance concerns under India’s privacy  framework due to ambiguities in its privacy policy, and its practice of storing user data in China.  

The Indian government is reportedly keeping a close watch on the rapid rise of DeepSeek’s  artificial intelligence model amid concerns over data security and citizen sovereignty, especially  given the company’s Chinese origins. The storage of DeepSeek user data in servers located in  China is already inviting scrutiny from various countries. US government officials are reportedly  looking into the national security implications of the app, Italy’s privacy watchdog is seeking more  information from the company on data protection, South Korea’s data protection authority, The  Personal Information Protection Commission (PIPC) under the Interior Ministry plans to send an  official inquiry to DeepSeek’s headquarters in China, requesting detailed information on the  startup’s policy on personal data collection. 

Union Minister of Information Technology, Ashwini Vaishnaw, announced that the Indian  government is set to host an open-source AI model similar to DeepSeek on domestic servers challenging the notion that building frontier AI models requires access to vast GPU resources. It  is recommended that to investigate the extent of data mining and web scraping government should  initiate a high-level investigation into the serious security concerns.  

Is there any safe way to use DeepSeek? 

Data privacy experts recommend the following precautions for mitigating risks associated with  DeepSeek usage: 

Account Creation: Avoid creating accounts using Google or Apple credentials to protect data stored  within those ecosystems. 

Chatbot Interactions: Refrain from submitting personally identifiable or sensitive information  during chatbot interactions, as all input data is used for AI model training and subsequently stored  in China.

VPN Usage: Employ a Virtual Private Network (VPN) to mask user location. 

High-Sensitivity Individuals: For individuals with heightened privacy concerns, such as  government employees or those handling sensitive data, abstaining from DeepSeek altogether is  the most secure approach.