A court upheld a penalty surcharge of about 6 billion won that Kakao Pay was ordered to pay by the Personal Information Protection Commission over allegations it sent the personal data of about 40 million people to China's Alipay.
The Seoul Administrative Court's Administrative Division 12 (presiding judge Kang Jae-won) on the 11th ruled against Kakao Pay in its suit seeking to overturn corrective orders and other dispositions issued by the Personal Information Protection Commission.
From June 2019 to May 2024, Kakao Pay transmitted to Alipay the IDs, mobile phone numbers, email addresses, whether a consolidation account was linked, the number of top-ups, and other information for 40.45 million customers. The cumulative number of transmissions reached about 54.2 billion. Customer consent was not obtained.
According to the Personal Information Protection Commission, Kakao Pay provided user information to create a model for calculating the "NSF (Non-Sufficient Funds) score," which Apple outsourced to Alipay. The NSF score is a metric assigned to each user to assess the likelihood of insufficient funds for payments by Apple service users.
In January last year, the Personal Information Protection Commission imposed corrective orders and a penalty surcharge of 5.96 billion won on Kakao Pay. Kakao Pay objected and in April last year filed an administrative suit against the commission seeking to overturn the disposition.
The court found that Kakao Pay did not obtain users' consent when providing personal information to Alipay. It said it was difficult to conclude that users knew, or clearly agreed, that the information would be used by Apple as a kind of credit evaluation indicator to assess customers' payment capability.
It is also known that Kakao Pay provided to Alipay information that included users who do not use Apple, such as those on Android. The court pointed this out and found the penalty surcharge disposition to be justified.
Kakao Pay said, "To fulfill our obligation to prevent fraudulent payments when using Apple services, we entrusted the information under thorough encryption and lawful procedures," adding, "We fully explained the unfairness of the Personal Information Protection Commission's sanctions, and we regret that the court viewed it differently." It added, "We will review the written judgment and decide on our future response."