Italy's Garante Issues DeepSeek Order Halting Processing of Users' Data

The move came only two days after the Garante asked the companies for information on 28 January about the personal data collected, its sources, the purposes and legal basis of processing, and whether data is stored on servers in China, what information is used to train the system and, where data is collected by web scraping, how users are informed. The chatbot had attracted global attention in the days before.

Why the Garante acted

According to the Garante's press release, the order followed a reply received from the companies that the authority considered wholly insufficient. The companies stated that they do not operate in Italy and that European data protection law does not apply to them. The Garante took a different view: the GDPR can apply to controllers established outside the EU where they offer services to, or monitor the behaviour of, people in the EU. The limitation measure was adopted under the authority's urgency powers.

What it means for AI providers

The case is a reminder that consumer-facing AI services offered into the EU must be ready to answer regulators' questions on data sources, training data, legal bases, transparency and international transfers from day one. Providers without an EU establishment do not benefit from the one-stop-shop mechanism, which means any national supervisory authority may act against them directly.

Who is affected

Italian users and businesses using DeepSeek's services are directly affected by the limitation on processing. Companies elsewhere in the EU that are considering integrating the model into their own products will need to assess the data protection position carefully, including where personal data is processed and how it may be transferred outside the EEA.

What happens next

The investigation will examine whether DeepSeek's processing complies with the GDPR. The limitation remains in place while the inquiry continues, and the companies may engage with the authority to address its concerns.

Sources

• Garante per la protezione dei dati personali: Intelligenza artificiale, il Garante privacy blocca DeepSeek (30 January 2025)
• Garante per la protezione dei dati personali: Provvedimento del 30 gennaio 2025 (DeepSeek)
• Garante per la protezione dei dati personali: Il Garante privacy chiede informazioni a DeepSeek (28 January 2025)