DeepSeek's transfer of user data to China is ‘unlawful,’ said a data protection official.