Facts
After concerns were raised about how the Chinese generative AI company DeepSeek handled data, the Personal Information Protection Commission (PIPC) opened a preliminary inspection. On 15 February 2025 DeepSeek suspended new downloads from Korean app stores. The inspection found that the company had transferred Korean users' personal data to companies in China and the United States without telling them. Beijing Volcano Engine Technology received device, network and app information and also the text users typed into prompts. The privacy policy was available only in Chinese and English and lacked items required by Korean law. DeepSeek said the transfer of prompt content stopped on 10 April 2025.
Question
The PIPC examined whether the transfer of user data abroad, and of prompt content in particular, met the legal-basis and disclosure requirements of the Personal Information Protection Act (PIPA). It also considered whether the absence of a Korean-language privacy policy breached the transparency duty. The inspection further covered whether the service verified users' age so as to protect children's data and whether a domestic representative had been designated. Finally, the PIPC had to choose the appropriate enforcement tool, and in particular whether a formal corrective recommendation would suffice.
Decision
At its plenary meeting on 23 April 2025 the PIPC issued a corrective recommendation to DeepSeek. The company was to establish a lawful basis for overseas transfers, immediately destroy the prompt content already transferred to Volcano Engine, and publish a privacy policy in Korean. It also recommended stronger protection for children's data and the designation of a domestic representative. If accepted within 10 days, the recommendation would be treated as a corrective order, and the company would have to report on implementation within 60 days. DeepSeek announced that it accepted the recommendation, and new downloads resumed on 28 April 2025 with a revised Korean privacy policy. Press reports noted that destruction of the prompts already sent to Volcano Engine had not yet been confirmed; the PIPC said it would check implementation.
Why it matters
The measure made explicit that prompt content entered into a foreign generative AI service is personal data subject to Korea's cross-border transfer rules. A voluntary download suspension, a preliminary inspection and a recommendation that becomes binding once accepted were used together, and the service was available again within about two months. The case illustrates the tools available to the regulator when dealing with overseas AI providers.