 |
Photo courtesy of Yonhap News |
[Alpha Biz= Kim Jisun] A South Korean court has ruled that Kakao Pay unlawfully transferred user data to Alipay, rejecting the company’s claim that the process constituted a legitimate outsourcing arrangement and upholding a regulatory fine.
The Seoul Administrative Court dismissed Kakao Pay’s lawsuit seeking to overturn a penalty imposed by the Personal Information Protection Commission, affirming that the transfer amounted to the provision of personal data to a third party without proper consent.
The case centered on whether Kakao Pay’s transfer of user information to Alipay’s Singapore entity between June 2019 and May 2024 qualified as data processing entrustment or required explicit user consent as a third-party data provision.
The court acknowledged that the encrypted personal data provided—such as phone numbers and email addresses—and the NSF (Non-Sufficient Funds) scores generated by Alipay are conceptually distinct. However, it ruled that, in practice, they should be regarded as substantially the same information when considering the full process of data transfer and processing.
The court found that the primary purpose of the data processing was to generate NSF scores used by Apple services to assess users’ payment risk. It noted that the economic benefits derived from the scores ultimately accrued to Apple, which uses them to determine billing methods and reduce payment failure risks.
It also rejected the existence of a direct outsourcing relationship between Kakao Pay and Alipay, stating that while Alipay may have had a processing relationship with Apple, such a relationship could not be established between Kakao Pay and Alipay.
On the issue of user consent, the court ruled that Kakao Pay users had agreed only to purposes such as identity verification, authentication, and billing—not to the transfer and transformation of their data into NSF scores for Apple’s payment and credit evaluation systems.
The court further criticized the inclusion of data from Kakao Pay users who do not use Apple services, stating that users could not reasonably anticipate that their personal information would be converted into a separate scoring metric and used externally. It concluded that this effectively violated users’ right to control their personal data.
Previously, the commission fined Kakao Pay 5.968 billion won for transferring the data of approximately 40 million users overseas without following proper procedures. The ruling is expected to influence ongoing deliberations by the Financial Services Commission regarding potential additional sanctions under credit information laws.
Alphabiz Reporter Kim Jisun(stockmk2020@alphabiz.co.kr)
