A view of the Seoul Court Complex in Seocho-gu, Seoul, seen from the courthouse clock tower. Reporter Seong Hyung-joo
A court has ruled that the Personal Information Protection Commission’s decision to impose a 6 billion won fine on Kakao Pay (377300.KS) was justified, after the company transferred the financial and personal data of 40 million customers to Alipay without their consent.
The 12th Administrative Division of the Seoul Administrative Court, presided over by Chief Judge Kang Jae-won, ruled against the plaintiff Thursday in a lawsuit filed by Kakao Pay against the Personal Information Protection Commission seeking to cancel its corrective order and other measures.
The commission imposed a fine of 5.968 billion won and issued a corrective order in January last year, saying Kakao Pay had provided the personal information of all of its roughly 40 million users to Alipay without consent for the purpose of evaluating Apple service users. According to the commission’s investigation, Kakao Pay transmitted the personal information of all its users to Alipay without consent on three occasions between April and July 2018, so that Alipay, an Apple subcontractor, could build a model to calculate NSF scores. The NSF score is a type of per-customer score calculated to assess the likelihood that an Apple service user has insufficient funds to cover payments.
The transmitted personal information included a total of 24 items, such as users’ mobile phone numbers, email addresses, and information related to the possibility of insufficient funds (including Kakao Pay sign-up dates and charged balances). The cumulative number of transmissions during this period was approximately 54.2 billion, estimated at 40 million people after removing duplicates.
In addition, while fewer than 20 percent of all Kakao Pay users had registered a payment method with Apple, Kakao Pay transmitted to Alipay the information of all users, including non-Apple users such as Android users.
Kakao Pay had argued that the transfer of customer information to Alipay was carried out under a lawful business consignment relationship. However, the court determined that it constituted “provision to a third party,” which requires customer consent. “The sole party to which the benefits from the NSF score calculation accrue is Apple,” the court explained.
The court found that Kakao Pay did not obtain consent from its simple payment users when it provided the information to Alipay. “It is difficult to conclude that the data subjects were aware, or gave specific and clear consent, that the relevant information would be used by Apple as a kind of credit evaluation indicator to assess customers’ payment capacity,” the court noted. It added, “Users cannot be deemed to have consented to having their right to self-control over personal information effectively nullified in the process of calculating NSF information.”
Meanwhile, in March this year, Kakao Pay filed an administrative lawsuit against the Financial Services Commission seeking to cancel its fine. The FSC imposed an institutional warning on Kakao Pay along with a fine of 12.976 billion won and a penalty of 48 million won.