In Carlo Collodi's 1883 book The Adventures of Pinocchio, Pinocchio arrives at Pleasure Island only to discover that behind the guise of an amusement park lies a sinister plan to turn children into donkeys and make a fortune from selling them. 142 years later, in 2025, a new artificial intelligence (AI) model called Deep Seek-R1 was unveiled, which, according to its developers purports, inter alia, to offer capabilities similar to Western models, and at significantly lower costs. Alas, the buzz silenced the voices of the jurists, who, like Gemini the Cricket 142 years earlier, sought to warn of the lurking dangers.
Thus, unlike Chat GPT, it is not possible to use the model without identification or in an Incognito mode, and the possibility of preventing the collection of information does not exist. Aa review of the (non-)privacy policy turns on additional blinding warning lights. Thus, for example, it is noted that location data, identifying details, and above all, under the innocent phrase "text input", all the information that the user enters while using it - is collected. Added to these is the "cherry" of storing the information on servers in China and specifying that the company will share the collected information with the authorities or any third party if it is (inter alia) a government request.
Contrary to its willingness to share users' information, the company did not cooperate sufficiently with an investigation conducted by the Italian Privacy Protection Agency (Garante) regarding the collection and storage of the information. In addition, the company insists that the European Union's privacy laws (GDPR) do not apply to it because it does not have a representative in the European Union, a position that directly contradicts the traditional position of the European Union, that the GDPR laws apply to the information of its residents. While Italy has completely blocked the use of the model and other countries such as Canada and Australia have restricted it, the Israeli authorities have chosen, so far, Ignore the Chinese dragon in the room. But what is the position of Israeli law in relation to the above issues?
Two of the principles underlying privacy protection laws in Israel are: the principle of consent (and the accompanying transparency requirement), which requires the collector to specify to the provider of the information all the relevant information in order to obtain his consent to share information, including what was collected, what the uses were, to whom it was provided, and for what purpose; and the principle of conjugation of purpose, which requires the information to be used only for the purpose for which it was collected. In the information collected and processed by AI, there is an inherent difficulty in upholding these principles, due to the inability of its operators to explain how it reached a certain conclusion, i.e., the exact use (if any) made (let alone will be made) of the specific information collected. However, the vague wording of the Chinese model's privacy policy and the manner in which the model is operated, including the impossibility of restricting the identification, collection and processing of information, or its deletion, lead to the exacerbation of these problems, contradicts the Israeli regulator's policy of limiting gathering of private information, and in practice undermines the ability of the subject of the collection to reduce the damage to it.
It should be noted that while the authorities focus on the personal information of individuals, there is also concern about the information of corporations. Thus, as we have written in the past, along with enormous promise, the artificial intelligence revolution entails multiple dangers for the individual and for the corporation. Therefore, it is vital to be accompanied by an attorney knowledgeable in the field before using these tools and their products.