OCU requests GDPR investigation into DeepSeek data handling
Spanish consumer organization OCU filed a complaint with the Spanish Data Protection Authority alleging that DeepSeek does not comply with GDPR requirements, including inadequate data transfer safeguards to China, lack of proper consent mechanisms, and insufficient age verification for minors. The OCU requested precautionary measures and investigation into the Chinese companies operating the service.
What happened
The OCU and organizations belonging to Euroconsumers examined DeepSeek to verify compliance with the European General Data Protection Regulation (GDPR).
The analysis found that international processing of personal data is conducted without adequate legal safeguards, consent is not requested appropriately, and there are doubts about age verification measures for minors and processing of their data without parental consent.
Reported impact
The OCU identified that DeepSeek's privacy policy does not clarify how user data is used, leaving unclear whether data is used for profiling or automated decision-making.
The organizations found that DeepSeek controllers are based in China without designating a representative to the European Union, personal data is transferred to China without adequate guarantees, and the privacy policy lacks required details such as data retention periods and user rights exercise methods.
Index analysis
The OCU requested the Spanish Data Protection Authority to investigate the companies responsible for DeepSeek service and to adopt appropriate precautionary measures to safeguard Spanish users' data protection.
The organizations requested that DeepSeek be prohibited from processing Spanish users' personal data until detected problems are resolved.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.