Fintech Industry on Alert After Kakao Pay's Defeat... Ripple Effects Expected Over 'Third-Party Data Provision'

Attention on Whether Kakao Pay Will Appeal
"Issue of Overseas Third-Party Provision" Spreads
If Simple Outsourcing Is Interpreted as Third-Party Provision
"Financial Service Structures May Need to Be Re-examined"

The fintech (finance + technology) industry is drawing significant attention following a court ruling that requires companies to verify the flow and intended use of data when sharing customer information with overseas partners via integrated global payment platforms. The judgment emphasizes that, when key data such as mobile phone numbers and linked account information are shared, companies must transparently obtain customer consent and enhance security measures to prevent overseas partners from using the data for unauthorized purposes, such as improving their own platforms. As a result, concerns are growing that new business ventures in areas such as financial artificial intelligence (AI), global payments, cloud, and stablecoins may be somewhat curtailed.

"Major Impact if Interpreted as Third-Party Provision, Not Simple Outsourcing"

According to the fintech industry on June 22, Kakao Pay lost a lawsuit against the Personal Information Protection Commission seeking to overturn corrective orders and other sanctions, raising questions about whether the company will file an appeal. On June 11, the 12th Administrative Division of the Seoul Administrative Court (Presiding Judge Kang Jaewon) dismissed all claims made by Kakao Pay. Kakao Pay is now required either to comply with a corrective order, a public announcement order, and a fine of 5,968,000,000 won imposed by the Commission in January last year, or to file an appeal and pursue a second trial. An industry insider commented, "It is known that Kakao Pay's legal team is considering an appeal. Since the issue involves the provision of information to overseas third parties, the entire industry is paying close attention to the reasoning of the court and the government."

The industry views with gravity the court's rejection of Kakao Pay's argument that it merely transferred information to its partner Alipay to help Apple build a fraudulent transaction prevention system for its services. The court, agreeing with the Commission, deemed Alipay an agent of Apple, not Kakao Pay, and concluded that Kakao Pay had transferred personal information overseas to a third party, Apple. The court further noted that Alipay calculated a non-sufficient funds (NSF) score for users based on the information provided, which Apple then checked to determine whether to approve payment and what billing method to use (single or batch). Given these facts, the court found it difficult to consider this a simple outsourcing arrangement.

Concerns Over Constrained New Business with Overseas Partners in AI, Stablecoins, and More

In light of this ruling, the industry is concerned that relationships with overseas partners will be subject to stricter scrutiny regarding the preparation of outsourcing documentation and disclosure obligations under domestic personal information protection laws. In particular, concerns have been raised that, during the process of publicly clarifying that the purpose of data transfer is information sharing and management activity between contractors—not third-party provision—companies may lose bargaining power in contract negotiations or face delayed administrative processes. A platform-based electronic financial business operator noted, "This is not an issue limited to fintech companies that do not handle payment services. When transferring information overseas, companies need to take advanced measures at the contract stage to ensure that overseas partners cannot use the information for their own platform model improvement work."

If, as the court ruled, overseas partners that have previously been interpreted as simple contractors are now considered 'third parties,' it may necessitate a review of the overall service structure in the financial sector. The industry has so far interpreted cooperation with external specialists for abnormal transaction detection (FDS), risk analysis, AI models, and cloud infrastructure as outsourcing. However, there is now a greater possibility that data transfers will be interpreted as third-party provision if external partners use their own proprietary algorithms. Another industry insider observed, "If the court's ruling is strictly followed, financial service frameworks for AI, cloud, and data analysis—which are difficult to operate solely with in-house systems and technical capabilities—may need to be completely overhauled. This will likely impact all forms of collaboration with overseas companies in the future."

Domestic Financial Innovation May Slow Down

Since the information at issue in the trial included mobile phone numbers, email addresses, and linked account details, the industry foresees difficulties in pursuing new business initiatives. If the additional consent process, legal review, and compliance costs increase when collaborating with global players such as Visa, Mastercard, Apple, and Google, the launch and innovation speed of new services by Korean financial firms could slow down. This could also pose a barrier for entering the Korean won stablecoin business, which requires collaboration with overseas blockchain infrastructure and global wallet providers. An industry insider stated, "If the boundaries of data outsourcing are interpreted narrowly, companies may hesitate to adopt new technologies due to concerns about legal risks."

However, some in the industry believe that if there were procedural issues in sharing personal information for marketing purposes, the government's judgment should be respected. An industry insider with expertise in B2B (business-to-business) transactions commented, "Although the burden of specifying the purpose of data use in contracts with overseas partners has increased, the court's decision should also be respected. If companies thoroughly encrypt and manage information, it should not pose significant problems for business or service operations."

This content was produced with the assistance of AI translation services.