Deepseek regulatory challenges make its AI a risky bet for Canadian organizations

Is the “deep effect” too good to be true?

Deepseek has positioned itself as a cost -effective alternative to its competitors, by reducing some of the expenses associated with the development and formation of AI models. With headquarters in China, he built AI instruments that compete with his competitors with a fraction of the cost. Unlike its own systems that retain their code secret, Deepseek uses the open-source development for its smaller and previous version models. Open-Source development allows users to download and modify the Deepseek code without expensive licenses. It is said that the “deep effect” – reducing high costs associated with development and adoption – improves access and encouragement of innovation.

While Deepseek promotes AI accessibility, the regulatory authorities wonder if its data protection measures keep up with its expansion. Several European data protection authorities have launched investigations on its compliance with GDPR, including the implications of storing personal data in a country with unlimited access to the users’ data. According to the GDPR, data transfers outside the EU are allowed if the welcoming country has “adequate” levels for protecting personal information. If not, transfers can be allowed, provided that are in force appropriate confidentiality transfers. Organizations must also ensure that people who have data have the right to access, correct, delete or oppose the processing of their information and to make legal remedies through the courts or regulators are available to be the data in case of improper use. The European regulatory authorities differ between these strict GDPR protection and the rights of users in accordance with the Law on personal information in the People’s Republic of China, to question whether the confidentiality framework fulfills the adequacy for cross -border data transfers.

The Data Regulatory Authority in Italy, Garanti, has requested information from Deepseek on user data management, including if personal information has occurred in China. Deepseek replied that it was not subject to European laws because it did not work in Italy. As a result, Garanti forbade the processing of Deepseek data in Italy, invoking confidentiality risks related to the China data protection framework. Belgium, France, the Netherlands and Luxembourg initiated similar investigations on Deepseek. The result of these investigations can prevent Deepseek’s adoption in Europe.

Transfrontal transfers of personal data

Deepseek investigations carry global implications, including Canada, where internal laws require strict requirements for personal data transfer to another jurisdiction. Protecting users data on borders is an essential concern for regulatory authorities and Canadian consumers. For example, while the Law on the protection of personal information and electronic documents (Pipeda) does not distinguish between internal and international data transfers, it puts the UN on private organizations to use contractual terms to ensure a comparable level of personal information when the data is transferred to any third party for processing. Since the Pipeda recognizes that the contracts will not replace the laws of another jurisdiction, it is necessary for the organizations to carry out their due diligence to exclude the transfers of personal information, taking into account all the elements of the transfer, including any legal requirements in the jurisdiction in which the third party operates that creates the risk of confidentiality. Failure to comply with these requirements will lead to regulatory intervention, monetary fines and reputational damages of the organization that manages the users’ data.

The bottom line

The cost saving approach reported by Deepseek to develop the AI ​​to make the industry more accessible, but the regulatory authorities question its users’ data storage policy in China. The result of these investigations can influence the perspectives of Canadian consumers and regulations on Deepseek. Understanding the confidentiality issues highlighted by the regulatory authorities abroad, the degree to align with the internal data protection standards and the company’s availability to cooperate with the authorities will determine how – and to what extent – Deepseek technology can be used in various sectors at home.