ITALY Trends and Developments Contributed by: Paolo Balboni, Luca Bolognini, Davide Baldini and Nicolò Maria Salvi, ICT Legal Consulting
the service. On this basis, the authority concluded that DeepSeek was unquestionably offering its services to individuals located in the EU, including Italy. As a con - sequence, the GPDP found that the GDPR applied extraterritorially on the basis of its Article 3 (2), as the service targeted individuals residing in the Union. The authority also noted that DeepSeek had failed to co-operate adequately with the investigation, having omitted to clarify key aspects of its data processing activities, therefore breaching its co-operation duties laid down in Article 31 GDPR. Several substantive shortcomings were also identi - fied. DeepSeek’s privacy policy was not available in Italian, but only in English, and did not meet the transparency and information requirements set out in Articles 12, 13 and 14 of the Regulation, as it missed a few mandatory requirements. In particular, it failed to clearly specify the legal bases relied upon for each processing activity, contrary to Article 6 GDPR, and did not provide sufficient information to enable data subjects to exercise their subjective data protection rights (eg, access, rectification, objection, portability, deletion, etc). Further concerns arose in relation to international data transfers and security. According to the privacy policy, personal data collected through the DeepSeek service were stored in the People’s Republic of China, with - out adequate safeguards being demonstrated, rais - ing issues under the data transfers regime foreseen by the GDPR, as strictly interpreted by the Court of Justice (most famously in the Schrems I and Schrems II judgments). Finally, despite being subject to the GDPR while being established in a third country, the companies had failed to appoint a representative in the EU, in viola - tion of Article 27. Given the seriousness of the findings and the ongoing nature of the investigation, the GPDP ordered, on an urgent basis, a definitive limitation on the processing of personal data of individuals located in Italy. The measure took immediate effect and was adopted without prejudice to any further enforcement action that may follow upon completion of the investigation.
Once again, the decision illustrates the GPDP’s readi - ness to intervene swiftly in the AI domain and its ambi - tion to remain a key EU data protection enforcer vis- à-vis global AI providers. Enforcement in the Field of Data Brokering Services Inquiry regarding Lusha Aside from the AI sector, the GPDP has also recently concentrated its efforts on enterprises providing data brokering services to the Italian market. One salient example is the enforcement action against Lusha Systems Inc, a US-based company that oper - ates an online platform offering so-called “enriched” contact data of potential leads. Through subscriptions purchased by its clients – typically sales, marketing and recruitment professionals – the platform allows users to identify or verify business contact details such as email addresses, landline numbers and mobile phone numbers of potential leads, including profes - sionals and other individuals working for companies that may be interested in their services, with a view towards contacting them by leveraging the contact data provided by Lusha. Lusha’s services are built around personal data-gath - ering and aggregation from multiple sources, includ - ing work-related social networks, websites of compa - nies, and many other third-party sources. The service therefore does not only include registered users of the platform, as the database may also include personal data relating to individuals who have never interacted with Lusha directly. Importantly from a jurisdictional perspective, the GPDP found that Lusha’s services are accessible from the EU and are actively offered to users located in EU member states, including Italy. Lusha’s database reportedly contains personal data relating to EU resi - dents, including Italian residents and, in some cases, individuals holding prominent institutional or senior professional roles. This circumstance was decisive in allowing the GPDP to assert its jurisdiction vis-à-vis Lusha. On 8 April 2025, the GPDP formally announced the opening of an investigation into Lusha. The decision
218 CHAMBERS.COM
Powered by FlippingBook