It is quite clear that not much can be expected from the initiative of the national protection authority. Unless one wants to raise the temperature of the confrontation to a higher level. With all the implied consequences by Andrea Monti – initially published in Italian by La Repubblica – Italian Tech
The news, currently only entrusted to a press release issued by the authority, is that the Data Protection Authority is blocking DeepSeek’ because – we read in an earlier statement – of a ‘possible risk to the data of millions of people in Italy’.
It is not clear what the authority means when it speaks of ‘blocking’ because the web platform is still usable, while the smartphone version, although no longer available on the Italian app stores, still works for those who have it installed.
To clarify the mystery, it is first necessary to consider that, as in the case of ChatGPT, the decision was taken without any objective basis, without any concrete evidence of harm to at least one citizen, but only on the basis of such an extreme application of the precautionary principle that it was essentially transformed into an act of arbitrariness.
The questionable legal reasons behind the DeepSeek block
Many strictly legal considerations could be made as to why the ‘blocking’ of DeepSeek does not make sense, as the one imposed on ChatGPT did not.
One could point out, for instance, that, as one of the German Data Protection Authorities rightly say, an LLM does not process personal data because it performs calculations on vectors not on data associated with persons, and therefore the national protection authorities are not entitled to deal with it.
Or one might ask what is the ‘possible risk’ for users if by definition an LLM does not produce reliable results and therefore should not be used to obtain answers on which to ground choices and decisions.
And one might therefore ask why similar measures have not been taken against search engine webscraping. Contrary to an LLM, in fact, the engines actually operate on personal data and produce results that constitute a risk for users; so much so that for years now there have been multiplying judgments – the first was Costeja vs Google Spain – ordering the de-indexing of content from search engines.
Finally, one should question the effectiveness of imposing – as has been done with ChatGPT – a disclosure obligation on Italian users, without blocking the use of the model itself, which continues to work outside Italian borders as if nothing had happened.
Aside from these, and other, aspects, it is instead useful to focus on some less obvious but no less important issues in this affair.
Blocking DeepSeek by intercepting Italian users?
One option to ‘block’ DeepSeek could be to order internet providers and telecommunications operators to ‘block’ the Chinese platform by ordering them to ‘filter’ user traffic, i.e. to carry out a mass interception.
Although, to date, there are no such orders issued against Italian operators, this does not change the terms of the matter, and it is to be hoped that it will not come to that, for a number of reasons.
Firstly, the Data Protection Authority does not have the power to issue such orders. To do so, a court order is needed, as happens in criminal proceedings, or a law that makes it possible, as happened (albeit with many issues) in the case of the law to fight the illegal streaming of sports event.
Moreover, the Authority orders should concern those who deal with personal data and not those who offer telecommunication network connection and data transport services (internet providers and telecommunication operators, in other words) that allow user to reach an online platform.
Finally, if DeepSeek’s ‘blocking’ were to be turned into yet another ‘filtering order’ -that is, of the systematic interception- of people’s Internet surfing, it would negatively affects the net neutrality and its services. It would, in fact, impose obligations (and liabilities) on subjects unrelated to the (theoretical) illegal activity without any law providing for it.
Block DeepSeek by removing the app?
Another possibility to block DeepSeek would be to make it disappear, as in fact happened, from the Italian app stores.
It matters little whether this was caused by the Data Protection Authority’s initiative, by political directives (such as the American executive order of 2019 that caused the blocking, later revoked, of the operation of Adobe software in Venezuela), by judicial measures, or by DeepSeek’s autonomous choice, because the uselessness of the solution remains as it is.
If in fact, and once again it is worth recalling the ChatGPT case, the problem is the model as such, having prevented Italian users from using it via the app only serves to limit any further data collection via smartphones, but certainly not to block the platform and all that it allows the rest of the world to do with the data already acquired.
Chinese data protection legislation and the risk of reciprocity
The stone guest in this affair is the Chinese equivalent of the GDPR. Like the EU regulation, Beijing’s is also structured to be applicable outside the borders of the People’s Republic of China. It is quite intuitive to assume, therefore, that if Italy claims the power to directly affect another nation’s borders, the other side might consider doing the same. If this were to happen, the consequences, even diplomatic ones, of such an event would be unpredictable.
The real (in)effectiveness of the Data Protection Authority’s initiative
To summarise: the Data Protection Authority cannot prevent DeepSeek from operating from China, the Italian authority’s actions have caused, at most, the removal or withdrawal of the smartphone app, any adopted measures will not affect the data already collected and used.
Given these premises, it is quite clear that one cannot expect much from the initiative of the national protection authority, unless the goal is to raise the temperature of the confrontation to a higher level, with all the inevitable consequences.