Unauthorized Overseas Transfer of 'Personal Information'... Kakao Pay and Apple Fined 8.4 Billion KRW

Personal Information Commission Imposes Fines on KakaoPay and Apple
Alipay, Entrusted by Apple to Process Personal Data, Receives Corrective Order

KakaoPay and Apple, which illegally transferred users' personal information overseas, have been fined a total of 8.4 billion KRW. Alipay, which scored customers' creditworthiness by utilizing customer personal information under a contract with Apple, received a corrective order.

The Personal Information Protection Commission (PIPC) held a plenary meeting on the 22nd and announced on the 23rd that it imposed fines of 5.968 billion KRW and 2.405 billion KRW on KakaoPay and Apple, respectively, for violating the overseas transfer regulations under the Personal Information Protection Act. Apple was also fined an additional 2.2 million KRW.

Goh Hak-su, Chairperson of the Personal Information Protection Commission

Last August, suspicions arose that KakaoPay had transferred personal information to Alipay without customer consent, prompting the PIPC to launch an investigation. As a result, it was confirmed that KakaoPay provided personal information of approximately 40 million users to Alipay without user consent. It was also confirmed that Apple failed to inform users that personal information was being transferred overseas and processed through Alipay, a third-country trustee.

KakaoPay Transferred All User Information to Apple and Alipay Without User Consent

This incident occurred during the process of enabling Apple services to be paid through KakaoPay. Through collaboration between the two companies, domestic users can use KakaoPay’s simple payment method for ▲ Apple’s subscription services such as iCloud ▲ paid app purchases on the App Store ▲ in-app purchases.

During the registration of the payment method, KakaoPay transmitted user personal information to Alipay. Alipay, entrusted by Apple, used the personal information to score the payment ability of customers who registered KakaoPay as a payment method.

The problem arose when KakaoPay provided personal information of all users to Alipay without consent. KakaoPay transferred personal information of all its users to Alipay three times from April to July 2018 without consent to enable Alipay, Apple’s trustee, to build a scoring model. The transferred personal information amounted to at least 15.9 million users’ data, including encrypted phone numbers, email addresses, and KakaoPay recharge balances.

In particular, it was found that personal information of users who used Android smartphones, unrelated to Apple, was also transferred to Alipay. Less than 20% of KakaoPay users registered KakaoPay as a payment method with Apple, but information of the remaining more than 80% of users was also transferred to Alipay.

Apple, which received personal information from KakaoPay, also failed to notify users about the outsourcing of personal information processing and overseas transfer. Apple entrusted Alipay with system integration tasks such as developing communication APIs for linking KakaoPay payment methods, but did not inform customers while processing KakaoPay users’ personal information. According to Article 63 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, users must be notified and give consent through privacy policies or other means before personal information is transferred overseas.

The PIPC ordered Alipay to destroy the scoring model for KakaoPay users. From June 27, 2019, to May 21 of this year, Alipay automatically received all user information daily from KakaoPay to calculate individual scores, which Apple then requested and received.

A PIPC official stated, "This investigation is significant in clarifying the scope of overseas transfer of personal information amid the recent expansion of global platform services and reaffirming that businesses must strictly comply with legal requirements for overseas transfers." He emphasized, "Businesses must obtain separate consent from data subjects or notify them through privacy policies that personal information will be transferred across borders when providing services involving overseas transfers."

KakaoPay and Apple are also expected to face separate sanctions from financial authorities. Jeon Seung-jae, head of the PIPC’s Investigation Team 3, said, "The PIPC’s disposition is not the final one," and added, "It is expected that the Financial Services Commission and the Financial Supervisory Service will impose penalties for violations of the Credit Information Act."

Regarding the scale of the fine imposed on KakaoPay, it was explained, "Considering that personal information was not leaked to places other than Alipay and Apple, and both had some level of control," but also noted, "Despite the large-scale transfer of personal information without sufficient review, management and supervision were not effectively conducted."

A KakaoPay representative said, "We deeply regret this outcome despite explaining that the procedure was necessary to provide a safe payment environment and the basis for processing," and added, "We will carefully review future responses and continue to provide explanations."

This content was produced with the assistance of AI translation services.