Japan fears gap in personal data protection with emergence of DeepSeek

The emergence of DeepSeek has caused many countries, including Japan, to worry about the issue of personal data protection. (Source: Bloomberg)

Although newly launched, the DeepSeek AI model has created a global buzz but also raised concerns about the lack of measures to protect personal information and data when it is misused.

Recently, the Japanese government has warned agencies about using this application for official purposes.

Previously, on February 3, Japan's Personal Information Protection Commission (PPC) issued a notice regarding the use of DeepSeek in the country. The data collected by DeepSeek is stored on servers in China and is subject to Chinese law. Tokyo is concerned that through DeepSeek, Beijing is likely to collect information for security or other purposes.

In Europe, Italy and Ireland have asked DeepSeek for information about how it handles personal data. The model has also been removed from phone app stores in Italy.

While DeepSeek is effectively supporting Japanese users, it is still unclear whether the app complies with Japan's Personal Information Protection Act.

Currently, DeepSeek's privacy policy is only available in two languages, Chinese and English, so senior members of the PPC believe that the application does not have to comply with the principles of the Personal Information Protection Act applicable to services aimed at Japanese users.

“Europe and Japan define personal information differently. Depending on how DeepSeek handles the data, the law may not be effective,” said Ryoji Mori, a lawyer familiar with Japan’s personal data protection regulations.

The European Union's (EU) General Data Protection Regulation also classifies indirect identifiers such as IP addresses as personal information. The requirements in Italy and other countries are also based on this regulation.

Meanwhile, Japan's data protection regulations are narrower, covering directly identifiable information like names and dates of birth. If DeepSeek did not collect this data, it would fall outside the law.

Japan's Ministry of Communications has drafted guidelines based on other relevant laws to ensure transparency by smartphone app providers, but these guidelines are drafted specifically for Japanese users and are also not legally binding.

The Japanese government recently planned to submit a bill to parliament that would give the government the power to investigate the malicious use of AI models. Many believe that this could allow for an investigation after the bill is passed.

However, the law may require certain criteria to be met before an investigation can be conducted, such as violations of the rights of Japanese citizens.

Additionally, the bill is unlikely to impose any legal obligations on businesses, so it is unclear how effectively the government can conduct investigations, according to lawyer Ryoji Mori.

Chuo University professor and expert on Internet law and regulation Kaori Ishii said it would be difficult for the government to take action unless the full scope of DeepSeek's services is clarified.

“As service apps from China become more popular, Japanese consumers should understand the risks associated with their personal information,” he stressed.