KakaoPay, South Korea’s popular payment platform, has witnessed an astonishing 14-fold increase in transactions made by foreign tourists within a year. (Image courtesy of Yonhap)
SEOUL, Jan. 23 (Korea Bizwire) — South Korea’s Personal Information Protection Commission (PIPC) has imposed fines totaling 8.3 billion won ($5.8 Million) on KakaoPay and Apple Pay for transferring the personal data of approximately 40 million users to China’s Alipay without proper consent.
The commission announced on Thursday that both companies violated South Korea’s Personal Information Protection Act by failing to notify users about the overseas data transfers.
The investigation revealed that KakaoPay provided Alipay with users’ personal information for Apple’s payment evaluation processes, including the calculation of an “NSF score,” which assesses the likelihood of insufficient funds during bundled microtransactions.
Between April and July 2018, KakaoPay transferred data—including phone numbers, email addresses, account balances, and other sensitive details—across 24 categories to Alipay on three occasions without user consent.
The data transfers involved all KakaoPay users, not just Apple Pay users, despite only 20% of KakaoPay users having registered payment methods with Apple Pay.
Alipay received daily updates from KakaoPay to calculate NSF scores and shared the results with Apple upon request. However, neither company disclosed these practices in their privacy policies or informed users that their data was being transferred internationally.
As a result, the PIPC levied a fine of 5.96 billion won on KakaoPay for “unlawful international data transfers” and ordered the company to address compliance issues. KakaoPay must also disclose the violations publicly on its website and app.
Apple was fined 2.45 billion won for failing to inform users about its outsourcing of data processing to Alipay and for not disclosing the data transfer in its privacy policy. The company was also ordered to correct its practices and publicize the violations.
Additionally, Alipay has been instructed to destroy its NSF score calculation models based on the transferred data.
While KakaoPay expressed regret over the decision, stating that it believed the data transfer was necessary to ensure a secure payment environment, the company plans to carefully review its response to the ruling.
The PIPC emphasized that further actions related to the unauthorized provision of financial data would be addressed by financial regulators, including the Financial Supervisory Service and the Financial Services Commission.
Kevin Lee (kevinlee@koreabizwire.com)
