Personal Information Protection Commission (PIPC) — Kakao Pay / Apple / Alipay
The PIPC fined Kakao Pay KRW 5.97 billion for unlawful cross-border transfer of ~40 million users' data to Alipay, and ordered Alipay to destroy the NSF-score algorithm/model it had built from the unlawfully transferred data.
Key takeaway — how to prevent this
Automated decision-making and risk-scoring must be tested for discrimination and be explainable to those affected; opaque algorithms applied to people draw regulatory action.
Case brief
Read from the authority's press release on 2026-09-06. Every holding carries a short verbatim quote from that text.
- Decided by
- Personal Information Protection Commission
- Parties
- Personal Information Protection Commission v. Kakaopay Corp. / Apple Distribution International Limited / Alipay Singapore E-Commerce Private Limited
- Decision date
- January 22, 2025
- Remedy
- The PIPC imposed an administrative penalty of KRW 5.97 billion on Kakao Pay, an administrative penalty of KRW 2.4 billion and a fine of KRW 2.2 million on Apple, and issued correction orders to all three entities including requiring Alipay to destroy its NSF score calculation model.
- Appeal
- Appeal status not stated
Key holdings
Kakao Pay violated data protection law by transferring personal information of millions of users to Alipay without obtaining their consent.
“The PIPC saw Kakao Pay’s provision of personal information to Apple (directly to Alipay) to build a model for calculating NSF scores without obtaining proper consent from users” — II. Sanctions / 1. Kakao Pay: An administrative penalty, along with correction and publication orders
Apple failed to notify users in its privacy policy about entrusting personal data processing and cross-border data transfers to Alipay.
“Apple entrusted system integration (SI) tasks to Alipay, including application programming interface (API) development that enables users to use payment methods for its services.” — I. Investigation Results / 2. Apple: Failures to inform data subjects of the entrustment of personal data processing and
Alipay was ordered to destroy its score calculation model because it was created using personal information provided without user consent.
“To address the root cause of violations of the PIPA, the PIPC issued a correction order on the third-party payment platform to destruct the model.” — II. Sanctions / 3. Alipay: A correction order
In plain English
The Personal Information Protection Commission of South Korea sanctioned Kakao Pay, Apple, and Alipay following an investigation into illegal cross-border transfers of personal data. Media reports revealed that Kakao Pay sent the personal data of all its users to Alipay without receiving proper consent from the individuals affected. Between April and July 2018, Kakao Pay extracted and transmitted information belonging to about 16 million users across 3 instances so Alipay could build a Non-Sufficient Funds score calculation model. Furthermore, from June 27, 2019, to May 21, 2024, Kakao Pay transmitted personal data daily from approximately 40 million users, including both iOS and Android users, even though iOS users accounted for less than 20% of its registered user base. The authority found that Apple entrusted system integration tasks to Alipay and allowed it to process personal data without notifying users in its privacy policy. Additionally, Alipay created and continuously updated its score calculation model using data transferred without consent. As a consequence, the authority imposed an administrative penalty of KRW 5.97 billion on Kakao Pay and issued correction and publication orders. Apple received an administrative penalty of KRW 2.4 billion and an administrative fine of KRW 2.2 million, along with correction orders. Alipay was ordered to destroy the Non-Sufficient Funds score calculation model.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.