Fintech Industry on Alert After Kakao Pay's Defeat... Ripple Effects Expected Over 'Third-Party Data Provision'

Attention on Whether Kakao Pay Will Appeal
"Issue of Overseas Third-Party Provision" Spreads
If Simple Outsourcing Is Interpreted as Third-Party Provision
"Financial Service Structures May Need to Be Re-examined"

As a court ruling has emphasized that fintech (finance + technology) companies must clearly verify the flow and usage purposes of customer information when linking with overseas platform payment networks and sharing such data with partner companies abroad, the fintech industry is paying close attention. There are calls for companies to transparently obtain consent for sharing key data items—such as mobile phone numbers and linked account status—and to strengthen security so that overseas partners cannot use such data to improve their own platforms without authorization. As a result, concerns are mounting that the expansion into new businesses such as financial artificial intelligence (AI), global payments, cloud services, and stablecoins may be hindered to some extent.

"Major Impact If Interpreted as Third-Party Provision, Not Simple Outsourcing"

According to the fintech industry on June 22, attention is focused on whether Kakao Pay will appeal after losing its lawsuit against the Personal Information Protection Commission to cancel corrective orders and other penalties. On June 11, the 12th Administrative Division of the Seoul Administrative Court (Presiding Judge Kang Jae-won) dismissed all claims filed by Kakao Pay, the plaintiff. Kakao Pay now faces the choice of either complying with the 5.968 billion won fine, corrective order, and disclosure order imposed by the Commission in January last year, or appealing and proceeding to a second trial. An industry insider stated, "It is known that Kakao Pay's legal team is considering an appeal," adding, "Since the issue involves providing information to overseas third parties, the entire industry is watching both the court's and the government's reasoning closely."

The industry is taking seriously the fact that the court did not accept Kakao Pay's argument that it merely transmitted information to partner Alipay to help Apple build a fraudulent payment prevention system. The court, like the Personal Information Protection Commission, viewed Alipay as Apple’s trustee rather than Kakao Pay’s, and ruled that Kakao Pay had transferred personal information overseas to a third party, namely Apple. The court noted that Alipay used this information to calculate a non-sufficient funds (NSF) score evaluating a user’s payment capacity, and that Apple accessed this score to determine whether to approve payments and to decide between single or batch billing. Given these facts, the court concluded that this could not be considered simple outsourcing.

Concerns Over Setbacks in New Businesses With Overseas Partners in AI and Stablecoins

Following this ruling, some in the industry express concerns that they will need to scrutinize the drafting of outsourcing documents and the public disclosure obligations regarding delegated work with overseas partners under domestic personal data protection laws more rigorously. In particular, there are concerns that the process of disclosing that the purpose of data transfer is not third-party provision but information sharing and business activity between contracting parties may weaken negotiating power or delay administrative procedures. An executive from a platform-based electronic financial business stated, "This is an issue that is not limited to fintech firms engaged in payment services," adding, "When transferring information abroad, companies must implement sophisticated operational measures at the contract stage to ensure that overseas partners cannot use such data for their own platform development work."

Some argue that if, as the court ruled, overseas partners previously considered mere trustees are now seen as ‘third parties,’ the financial sector must fundamentally review its service structures. The financial industry has interpreted cooperation with external specialists—for systems such as fraud detection (FDS), risk analysis, AI models, and cloud infrastructure—as outsourced work. However, if external providers use proprietary algorithms, there is now a greater risk of such data transfers being interpreted as third-party provision. Another industry insider noted, "If the court’s ruling is strictly applied, financial service structures that rely on AI, cloud, and data analysis—impossible to operate with only in-house systems and technology—may need to be completely overhauled. This will affect the overall approach to partnerships with overseas companies going forward."

Innovation Among Domestic Financial Firms May Slow

The information items at issue in the trial—such as mobile phone numbers, email addresses, and linked account information—suggest that similar difficulties will arise in new business development efforts. When working with global players such as Visa, Mastercard, Apple, and Google, additional consent procedures, more legal reviews, and higher compliance costs could slow the release and innovation of new services by Korean financial institutions. This could also be an obstacle for Korean won-based stablecoin projects, which require collaboration with overseas blockchain infrastructure and global wallet providers. An industry insider said, "If the scope of permissible outsourcing is interpreted too narrowly, concerns over legal risks may cause companies to hesitate to adopt new technologies at all."

However, some in the industry argue that if there were procedural issues in sharing personal data for marketing purposes, the government’s decision should be respected. An industry expert with a background in B2B (business-to-business) transactions stated, "Although the burden of specifying the purpose of data use in contracts with overseas partners has increased, the court’s decision must be respected. If companies thoroughly encrypt and manage information, it should not pose a major problem for business or service operations," the expert added.

This content was produced with the assistance of AI translation services.