A court has ruled that when domestic Fintech corporations hand over customer information while linking to overseas platform payment networks, they cannot easily avoid responsibility for cross-border transfers of personal information based only on a contractual phrase such as "simple outsourcing." The ruling says corporations must verify where the customer information actually went and for whose benefit it was used. The decision is expected to ripple through the Fintech industry, where partnerships with overseas easy-payment and platform operators are increasing.
The Seoul Administrative Court's Administrative Division 12 (Presiding Judge Kang Jae-won, Director General judge) on the 11th dismissed in full Kakao Pay's suit seeking to overturn corrective orders and other dispositions imposed by the Personal Information Protection Commission. As a result, the Personal Information Protection Commission's penalty surcharge of 5.968 billion won imposed on Kakao Pay in Jan. last year, along with corrective and disclosure orders, was upheld.
◇ Court: "Linking to overseas payment networks is not mere outsourcing"
The key issue in the case was whether Kakao Pay's act of transmitting customer information to Alipay could be deemed "processing outsourcing" for Kakao Pay's payment operations. Kakao Pay argued it transferred information to Alipay to build a system to prevent fraudulent payments in Apple services. The court, however, viewed Alipay not as Kakao Pay's trustee, but as Apple's trustee. It found that Kakao Pay transferred personal information overseas to Apple, a third party, via Alipay.
According to the court, from June 27, 2019, to May 21, 2024, Kakao Pay transmitted approximately 54.2 billion items of information on about 40.45 million customers to Alipay without the data subjects' consent. The transmitted items included 24 categories such as hashed internal customer numbers, mobile phone numbers, email addresses, sign-up timestamps, whether there was a linked account, and top-up counts. It was found that information of customers who did not use Kakao Pay payments in Apple services was also included.
Based on this information, Alipay calculated a non-sufficient funds score (NSF score) to assess whether users could properly pay the settlement amount. When Kakao Pay users paid in Apple services, Apple queried this score from Alipay and used it to decide payment approval and whether to bill per transaction or in batches.
The court held that the NSF score was used for Apple's benefit, not Kakao Pay's. In a structure where Apple pays Alipay fees per transaction, the score could be used to reduce fees and minimize the risk of payment defaults.
◇ "Actual data flows take precedence over contracts"
The court found that while customer information and the NSF score created by Alipay were formally separate, they should be viewed as a single flow of information in the overall processing. If Kakao Pay's customer information was transmitted to Alipay and then processed into a score to be used in Apple service payment processes, it cannot be sliced off and treated as a separate piece of information.
The claim that Kakao Pay entrusted its own operations to Alipay was also rejected. The court found that Kakao Pay and Alipay did not prepare the outsourcing documentation required under the Personal Information Protection Act and related regulations, and they did not fulfill the obligation to disclose the trustee and outsourced tasks on the website. In the end, it deemed that more important than contractual labels are where the information actually moved, who used it, and to whom the benefit accrued.
◇ Fintech industry: "We need to reexamine overseas partnership structures"
Legal circles say the ruling will serve as an important benchmark for Fintech corporations that link to overseas payment networks or global platforms. This is because there are growing cases in which personal information is processed after passing through multiple overseas operators in areas such as easy payments, app market payments, overseas remittances, and global membership integrations.
Attorney Kim Jeong-eun of Law Firm DR&AJU said, "First, it is essential to clearly understand the boundary between third-party provision and outsourcing of personal information processing," adding, "A transfer to an overseas operator is not necessarily a third-party provision, but from the outset you must examine whether the purpose and nature of the cross-border transfer constitute outsourcing or third-party provision."
Attorney Lee Dong-guk of Law Firm Dongin said, "As long as personal information is transferred overseas, issues of third-party provision and cross-border transfer are inevitably implicated," adding, "When Fintech and easy-payment companies contract with overseas vendors and hand over personal information, they may treat it as mere contract performance or a consignor–consignee relationship and miss specifying the recipient and purpose in individual consent or in the privacy policy."
◇ "'We didn't know' is not an exculpatory defense"
Experts note that saying they did not know how overseas companies actually used the information they received is also unlikely to serve as an exculpatory defense. If it is outsourcing, the purpose of use must fall within the domestic consignor's business scope, and if it is third-party provision, the third party's purpose of use must be disclosed to data subjects and consent obtained.
Kim said, "If it is outsourcing, the purpose must be within the domestic consignor's business scope, and if it is third-party provision, the third party's purpose of use must be disclosed to data subjects and consent obtained," adding, "In either case, the excuse of not knowing will not fly."
Kakao Pay said, "To fulfill our obligation to prevent fraudulent payments in Apple service payments, we entrusted information in strict compliance with encryption and due procedures, and we fully explained that the Personal Information Protection Commission's sanction was unjust," adding, "We are disappointed that the court viewed it differently." On whether it will appeal, the company said, "We will first analyze the written judgment and then decide."