Kakao Pay and Apple Pay have been fined a total of 8.3 billion won for transferring personal information of about 40 million customers to China's Alipay without obtaining consent.
The Personal Information Protection Commission noted on the 23rd that it had approved penalty surcharges and corrective orders against Kakao Pay and Apple Pay for violating the Personal Information Protection Act during an entire meeting the previous day.
According to the investigation by the Personal Information Commission, Kakao Pay provided the personal information of all its users, approximately 40 million, to Alipay without consent for Apple's user evaluation. At that time, Kakao Pay was transmitting customers' payment information to Apple through Alipay.
In this process, Apple entrusted Alipay with the processing of personal information related to payment handling, including the calculation of 'NSF scores.' The NSF score is a customer-specific score that rates users from 0 to 100 based on the likelihood of insufficient funds when billing multiple small payments made by the customer within Apple’s services.
During this period, Kakao Pay transmitted the personal information of all Kakao Pay users to Alipay three times between April and July 2018 without consent, enabling Alipay, as Apple's entrusted company, to establish the NSF score calculation model.
The transmitted personal information included 24 items such as the user's mobile phone number, email address, and information related to the likelihood of insufficient funds (Kakao Pay subscription date, recharge balance, etc.). The total cumulative transmission count during this period is approximately 54.2 billion, estimated to affect around 40 million users after removing duplicates.
Although less than 20% of all Kakao Pay users had registered payment methods with Apple, Kakao Pay transmitted information of all users, including Apple users and even Android users who did not use Apple, to Alipay.
In Apple's case, it was revealed that they entrusted Alipay to process Kakao Pay users' payment information and personal information for NSF score calculation, without informing users about this fact or the overseas transfer of information through their personal information processing policy.
Accordingly, about 40 million Kakao Pay users had difficulty knowing that their information was being transferred overseas for processing.
Alipay receives automatic transmissions of all users' information from Kakao Pay daily to calculate individual NSF scores and has been found to return the NSF scores of users at Apple's request.
As a result, the Personal Information Commission imposed a penalty surcharge of 5.968 billion won on Kakao Pay for providing personal information of all users to Apple without consent, judging it as 'an overseas transfer without legal processing grounds.'
Additionally, they issued a corrective order to ensure the legality of the overseas transfer and to announce the relevant facts on their website and application.
In Apple's case, they were fined 2.405 billion won for not notifying the information subjects about the outsourcing of overseas personal information processing and imposed a fine of 2.2 million won for failing to disclose the outsourcing fact.
They issued a corrective order to specify the fact of overseas transfers in the personal information processing policy and to announce the relevant facts on their website and application.
Alipay has been ordered to destroy the NSF score calculation model.