KCC: "Toss, Kakao, Naver Fail as Identity Verification Agencies"

Evaluation Results: None of the Three Sites Met the Standard of 92 Items

[Asia Economy Reporter Cha Min-young] Last September, internet operators such as Toss, Kakao, and Naver applied for new designation as identity verification agencies, but they were ultimately rejected following the Korea Communications Commission's review. The review committee unanimously agreed that institutional improvements are necessary as safety is not guaranteed.

KCC Finds 3 Agencies Did Not Meet Review Criteria

The Korea Communications Commission (KCC) announced on the 9th that as a result of the 8th committee meeting held in 2021, Viva Republica, which operates Toss, Kakao, and Naver were not designated as identity verification agencies.

The KCC explained, "Viva Republica, Kakao Corporation, and Naver Corporation, which applied on September 22 last year, were not designated as identity verification agencies," adding, "The review committee judged that the three applicants did not meet the designation criteria."

Toss required improvements in 17 out of 92 total items and received two items judged as unsuitable. These related to facilities for issuing identity verification information and generating, issuing, and managing alternative means. Kakao was asked to improve 17 items and received an unsuitable judgment on the uniqueness of identity verification information. Naver also was asked to improve 17 items and received an unsuitable judgment on the uniqueness of identity verification information.

Regarding this, Toss, which requested the review, argued, "These are minor issues that can be remedied during the review period." Kakao and Naver responded, "Initial account registration is anonymous, but subsequent identity verification services convert to real-name after identity authentication and account ownership verification, ensuring uniqueness."

Review Committee Prioritizes Safety Over Convenience

The standing members of the review committee judged safety as the top priority over convenience among the 92 review items essential for safe operation. Since personal information is involved, systems allowing anonymous registration could lead to significant damage to individual customers through hacking in the future.

Standing member Kim Hyo-jae stated, "Meeting qualification requirements does not automatically guarantee approval; it is a business requiring KCC's discretion." He added, "Toss requests conditional approval, but fundamentally, this is judged unsuitable," and noted, "Past similar cases were approved after pointing out minor issues requiring reflection and submitting improvement plans followed by implementation checks, which differs from the current situation."

Regarding Naver and Kakao, he pointed out, "Identity verification must prove the uniqueness of 'I am me,' but Naver and Kakao allow anonymous registration," adding, "Although they convert to real-name later, experts say there is a point during this process where hackers could steal information, which could lead to a major loss of safety."

Standing member Kim Chang-ryong said, "All three companies have one or more major unsuitable issues," emphasizing, "There may be misunderstandings that this review blocks the government's priority ICT activation efforts, but while convenience is important in designating verification agencies, safety is paramount." He added, "Based on the Network Act, the KCC has an obligation to designate applicants who can stably develop and provide alternative means as identity verification agencies."

Han Sang-hyuk, chairman of the KCC, said, "I can say that during the review process, we comprehensively considered opinions emphasizing at least user benefit demands and the value of protection and safety since private personal information is collected." He added, "Since these are operators handling identification information, it would be problematic if there is room to use identification information for purposes other than intended," and requested, "Please also review whether current laws and review standards can dispel such concerns, as post-incident responses can cause many problems."