[Exclusive] Police Conduct Two Consecutive Days of Raids on Kakao Pay Over Personal Data Leak

Headquarters of Kakao Pay Raided Over Two Days
54.2 Billion Pieces of Customer Data Transferred to Alipay Without Consent
Kakao Pay Appeals After Losing Lawsuit to Overturn Fine

The police recently conducted a search and seizure operation targeting Kakao Pay, which transferred as many as 54.2 billion pieces of personal information to Alipay, a Chinese mobile payment service, without obtaining customer consent. With the large-scale data breach first uncovered by the Financial Supervisory Service now entering the phase of a formal criminal investigation, efforts to determine the legality of Kakao Pay’s personal data processing are accelerating.

The Anti-Corruption and Economic Crimes Investigation Unit of the Gyeonggi Nambu Provincial Police Agency announced on July 9 that it had dispatched investigators to the headquarters of Kakao Pay in Seongnam, Gyeonggi Province to execute a search and seizure on suspicion of violating the Credit Information Act. The operation took place over two days, July 6 and 7. The police reportedly secured internal documents and electronic data necessary to clarify both the circumstances in which Kakao Pay provided a massive volume of customer information to Alipay and the legality of the user consent processes employed.

Inside the headquarters of Kakao Pay in Seongnam, Gyeonggi Province. Kakao Pay

According to the police and the Financial Supervisory Service, Kakao Pay is suspected of having illegally transmitted 54.2 billion pieces of personal information belonging to approximately 40 million customers to Alipay in China, without customer consent, between 2018 and May 2024.

This large-scale data breach occurred during the process in which Apple iPhone users registered Kakao Pay as a payment method. At the time, Kakao Pay transmitted customer payment information to Apple via Alipay as an intermediary. During this process, it was revealed that encrypted mobile phone numbers, email addresses, and account balances, among other data, were transferred to Alipay without authorization. Investigations found that Alipay used the received information for tasks such as constructing models for NSF (Non-Sufficient Funds) scores, which are calculated to assess the likelihood of insufficient funds for each customer.

This incident came to light when the Personal Information Protection Commission announced in January last year that it had imposed a penalty of 5.968 billion won on Kakao Pay. Subsequently, the Financial Supervisory Service investigated Kakao Pay, issuing an institutional warning—which constitutes a severe disciplinary action—in February this year, along with a fine of 12.976 billion won and an administrative surcharge of 4.8 million won. Furthermore, the Financial Supervisory Service requested a police investigation in March, and the Gyeonggi Nambu Provincial Police Agency has since been analyzing the data received from the Financial Supervisory Service.

With the police investigation into Kakao Pay intensifying, a key issue has emerged: whether Kakao Pay’s provision of information to Alipay can be recognized as a legitimate work outsourcing arrangement. According to the Credit Information Act, consent from the data subject is required to provide collected personal credit information to others. In the case of Alipay, as it is a foreign corporation, consent for cross-border data transfer is also necessary. Since it has been revealed that Alipay used the data received from Kakao Pay for purposes beyond payment processing—such as constructing NSF score models—there are criticisms that such use of information falls outside the legitimate scope of entrusted payment work, meaning the outsourcing relationship does not apply.

Kakao Pay interprets the Credit Information Act as allowing the transfer of information via an entrusted company without requiring the consent of the data subject. However, when the Personal Information Protection Commission announced its imposition of surcharges related to this incident in January last year, it explained, "Since there was no agreement or safety mechanism stipulating that Kakao Pay, as the entrusting party, would remain responsible, the relationship between the two companies cannot be considered an outsourcing arrangement."

Kakao Pay maintains its position that its provision of information was lawful under a work outsourcing arrangement and has filed an administrative lawsuit challenging the sanctions imposed by the Personal Information Protection Commission. However, the Seoul Administrative Court dismissed all claims by the plaintiff on June 11, upholding the penalties, including the surcharge, imposed by the commission. Nevertheless, Kakao Pay filed an appeal on June 24, again objecting to the court’s judgment that the surcharge was justified.

Meanwhile, the court of first instance stated, "The consent obtained by Kakao Pay from all users was for customer identification, identity verification and authentication, and payment settlement; such consent alone cannot be deemed as users’ clear agreement to data transfer or to the use of their information in the calculation of NSF scores." The court also noted, "Since individuals’ control over their personal information was neutralized in the process of calculating NSF scores, it cannot be said that there was valid consent from the data subjects."

This content was produced with the assistance of AI translation services.