'Personal Data Headed to China, Blocked in Germany'

"AI crosses borders, but data cannot." German data protection authorities officially sanctioned Chinese AI chatbot app "DeepSeek" for allegedly transmitting EU citizens personal information to China without authorization. This action invoking both the EU Digital Services Act (DSA) and General Data Protection Regulation (GDPR) simultaneously is expected to be recorded as the first case of global AI technology and national data sovereignty directly colliding. The June 27, 2025 Berlin DPA ruling: Germany Berlin State "Committee for Data Protection and Freedom of Information" officially announced that the DeepSeek AI chatbot service operated by a Chinese company violated Germany and EU data protection law. The violations alleged: (1) Transfer of German/EU user personal data (prompts, usage patterns, device information) to Chinese servers without legal basis; (2) Failure to provide transparent privacy policy explaining what data is collected and where it is sent; (3) No adequate data protection agreement for third-country transfer as required by GDPR Article 46; (4) Chinese government access risk -- Chinese law requires companies to provide data to authorities upon request, creating inherent compliance conflict with GDPR. The DSA application: the DSA "illegal content" notification enables the DPA to request Apple and Google remove DeepSeek from their app stores in Germany -- extending enforcement from the app developer to platform gatekeepers. EU-China AI data sovereignty implications: this case establishes that Chinese AI applications operating in the EU must comply with GDPR data localization and transfer requirements regardless of where the company is headquartered; the principle that "technology may cross borders but data must stay within law" applies equally to AI applications as to other software; other Chinese AI applications (Baidu ERNIE, Alibaba Qwen, ByteDance AI tools) face the same compliance question in European markets.