Court upholds near-6 billion won penalty on Kakao Pay over user data sent to Alipay

A Korean court upheld a 5.96 billion won ($3.9 million) penalty surcharge against Kakao Pay for transferring the personal data of about 40 million customers to China's Alipay without their consent.

The Seoul Administrative Court ruled Thursday against Kakao Pay in its suit to overturn a corrective order and other sanctions imposed by the Personal Information Protection Commission (PIPC).

The PIPC issued the corrective order and the 5.97 billion won penalty surcharge in January 2025 after concluding that Kakao Pay had provided the personal data of all of its roughly 40 million users to Alipay without their consent.

The regulator found that Kakao Pay provided the user data to help build a model for calculating so-called NSF scores, which Apple had commissioned Alipay to produce. An NSF, or Non-Sufficient Funds, score is a customer-level credit score used to assess the risk of Apple service users lacking sufficient funds to make a payment.

The PIPC also imposed a 2.41 billion won penalty surcharge and a 2.2 million won administrative fine on Apple for failing to notify users that the overseas processing of their data had been outsourced.

The court found that Apple had benefited from the data because Kakao Pay's user information had been transferred to Apple.

"The plaintiff did not obtain consent from users of its payment service when it provided their information to Alipay," the court said. "It is hard to conclude that the data subjects recognized, or specifically and clearly agreed to, the information being used by Apple as a kind of credit-assessment metric to evaluate customers' ability to pay."

The court also pointed to Kakao Pay's transfer of data from all of its users, including Android users and others who do not use Apple services, as grounds for finding the penalty surcharge lawful.

"Users cannot be regarded as having consented to the effective nullification of their right to control their own personal information in the process of calculating NSF information," the court said as it dismissed all of Kakao Pay's claims.

Kakao Pay said after the ruling that it had transferred the data under lawful procedures and with strong encryption to meet its duty to prevent fraudulent payments for Apple services.

"Kakao Pay fully explained why the PIPC's sanctions were unfair, and we regret that the court made a different judgment," the company said. "We plan to decide our future response after reviewing the written judgment."

BY SHIN HYE-YEON [[email protected]]