China's generative artificial intelligence (AI) model DeepSeek, which has been embroiled in controversy over personal information collection, has been confirmed to have partially revised its personal information processing policy.
In revising this personal information processing policy, DeepSeek has established additional terms for European Economic Area (EEA) countries, including the United Kingdom and Switzerland, but Korea is not mentioned, necessitating caution.
According to the personal information processing policy (privacy policy) updated by DeepSeek on the 15th (local time), items such as 'user keyboard input patterns' that were in the collection information category of the existing policy have been deleted.
User keyboard input patterns are items that can identify individual characteristics and infer passwords, potentially violating personal information.
DeepSeek has maintained its practice of storing collected information in China. However, it has added a clause stating that it will 'use protective measures to transfer personal information to specific countries if necessary.'
'Opt-out,' which had not been implemented until now, has also not been provisioned this time. Opt-out is a feature that allows information subjects to explicitly refuse the collection of their data.
In the additional terms for European countries, DeepSeek pledged to use 'personal data of users from the affiliated country only within the limits permitted by law.' Additionally, it detailed the types of personal information collected and separately guided the legal basis for its use.
This is seen as a measure following several countries' bans on the use of DeepSeek on government-owned devices.
However, individual policies regarding Korean users were not established in this revision. Previously, the Personal Information Commission sent an official inquiry to DeepSeek headquarters on the 31st of last month regarding the data collection and processing methods in the development and provision of the service.
The main contents of the inquiry include the personal information processing body, collection items and purposes, methods of collection, use and storage, and sharing status. A representative from the Personal Information Commission noted, 'We have not yet received a response letter from DeepSeek regarding the inquiry.'