[Startup Must-Know Laws] Did KakaoPay Illegally Transfer Information to Alipay?

Personal Information Processing Consignment vs. Third-Party Provision
Lessons from the KakaoPay Case

Attorney Heecheol An, DLJ Law Firm

On the 13th, the Financial Supervisory Service announced that KakaoPay's transfer of personal information to Alipay was illegal. In response, KakaoPay posted a statement titled 'Notice Regarding Articles on Apple/Alipay Information Provision' on its website and immediately issued a clarification. The positions of the Financial Supervisory Service and KakaoPay are sharply opposed.

According to the Financial Supervisory Service's investigation, this incident can be divided into two main issues. The first issue is that KakaoPay provided personal information to Alipay for the purpose of calculating the NSF (Non-Sufficient-Funds) score. The NSF score is a customer-specific credit score necessary for Apple’s unified payment system operation. Alipay requested the credit information of all customers from KakaoPay under the pretext of calculating the NSF score, and KakaoPay provided the personal credit information of all customers, including those who did not use overseas payments, once daily from April 2018 until now, totaling 54.2 billion cases (cumulatively 40.45 million people). The second issue is that when domestic customers make payments with KakaoPay at overseas merchants, KakaoPay provided Alipay with unnecessary customer credit information beyond the order payment information required for settlement.

The core of this incident lies in the first issue. KakaoPay argued that this provision of personal information falls under credit information processing consignment, which does not require the consent of the data subject, and therefore is not illegal. However, the Financial Supervisory Service judged that this provision of personal information is not a consignment relationship but a third-party provision of personal information. In personal information processing consignment, the trustee processes information for the benefit of the consignor, whereas third-party provision processes information for the benefit of a third party. Personal information processing consignment can be anticipated by the data subject in advance, but third-party provision is difficult to predict beforehand. In the case of personal information processing consignment, the consignor must have the authority to manage and supervise the trustee, and when consigning personal information processing, the consignor and trustee must enter into a consignment contract and report it to the Financial Services Commission.

The Financial Supervisory Service judged that Apple Store entry is a business beneficial to both KakaoPay and Alipay. Therefore, the provision of personal information by KakaoPay to Alipay for the purpose of calculating the NSF score was not for the benefit of the consignor but for the respective benefits of KakaoPay and Alipay. Additionally, it was judged that KakaoPay customers found it difficult to recognize at the time of subscription that their personal information could be provided overseas due to Apple Store entry. According to the Financial Supervisory Service’s findings, KakaoPay never managed or supervised Alipay as a consignor and could not even verify work details due to Alipay’s security reasons. Moreover, there was no evidence of a contract between KakaoPay and Alipay indicating that personal information was consigned for NSF score calculation. Considering these points, the Financial Supervisory Service concluded that this information transfer is a third-party provision, not personal information processing consignment.

There is a significant difference between personal information processing consignment and third-party provision. Personal information processing consignment does not require the consent of the data subject, but third-party provision requires obtaining the data subject’s consent. If credit information is transferred without understanding this, the Financial Services Commission may impose a fine of up to 3% of total sales. KakaoPay’s 2023 sales were 615.4 billion KRW based on consolidated financial statements and 555.6 billion KRW based on separate financial statements. Therefore, if KakaoPay’s transfer of credit information to Alipay is interpreted as third-party provision rather than personal information processing consignment, KakaoPay could face fines of up to approximately 18 billion KRW.

Whether KakaoPay actually violated the Credit Information Act or the Personal Information Protection Act is expected to be revealed through further investigations and legal disputes. However, since the Financial Supervisory Service has judged KakaoPay’s personal information transfer as illegal, KakaoPay’s management is likely to suffer significant damage. It is important to carefully examine KakaoPay’s case to properly understand the difference between personal information consignment and third-party provision and to handle personal information lawfully.

Attorney An Hee-cheol｜Law Firm DLG

Current Adjunct Professor, Department of Industrial and Management Engineering, Pohang University of Science and Technology

Current Director, Korea Angel Investment Association

Current Member, Legal Advisory Group for Startup Online Legal Support Project, Ministry of SMEs and Startups

Current Head, Startup Legal Support Group