Financial and Data Protection Authorities, Now Police... Concerns Over Business Slowdown Amid Triple Sanctions Risk for Kakao Pay

Key Issue: Potential Violations of Credit Information, Personal Information Protection, and Electronic Financial Transactions Acts

Authorities: "Provision to Third Parties, Not Work Delegation"... If Their Legal Interpretation Prevails

New B

Following the financial and data protection authorities, the police have now also launched a compulsory investigation into allegations of overseas leakage of Kakao Pay customer information, raising concerns that the overall business activities and new business development in the fintech industry may become subdued. Although there is a legal basis permitting the processing of credit information for the purpose of business outsourcing, multiple agencies are continuing to pressure Kakao Pay with similar reasoning. Industry insiders warn that the excessive costs of internal controls could trigger a vicious cycle that weakens the growth engine of companies.

Authorities, Police, and Courts: "Provision to Third Parties" vs. Kakao Pay: "Business Outsourcing"

According to the fintech industry on July 10, the Anti-Corruption and Economic Crime Division of the Gyeonggi Southern Provincial Police Agency conducted a compulsory investigation at Kakao Pay's headquarters in Seongnam, Gyeonggi Province, for two days from July 6 to 7. Some in the industry argue that it is excessive for investigative agencies, in addition to the financial and data protection authorities, to pressure companies based on the same legal grounds.

The level of sanctions already imposed is also considerable. Kakao Pay has been hit with an institutional warning and fines totaling 12,976 million won from the Financial Services Commission, along with an administrative fine of 48 million won. The Personal Information Protection Commission has also issued a corrective order and imposed a fine of 5,968 million won.

The core issue for the authorities, police, and courts is whether Kakao Pay violated Article 32 of the Credit Information Act, Article 21 of the Electronic Financial Transactions Act, and Article 28 of the Personal Information Protection Act. These bodies believe that Kakao Pay provided information to overseas companies—third parties—without customer consent, and also neglected its obligation to establish internal controls related to information outsourcing and disclosure obligations.

This directly contradicts the legal exemption clauses that Kakao Pay is using as its primary defense. Kakao Pay claims that, in accordance with Article 17 of the Credit Information Act and Article 26 of the Personal Information Protection Act, the outsourcing of credit information during the course of business operations should be recognized as a legitimate act under current law.

After losing the first trial in an administrative lawsuit filed against the Personal Information Protection Commission on June 11, Kakao Pay has proceeded with the appeals process. Detailed schedules such as the hearing dates have not yet been confirmed.

"Triple Sanctions Based on Similar Reasoning Are Excessive"... Close Attention to Potential Prolonged Litigation

The industry is paying close attention to the fact that the police have charged Kakao Pay executives and employees as suspects and applied charges of violating the Credit Information Act and the Electronic Financial Transactions Act. This is because the police’s legal reasoning aligns with that of the Financial Services Commission, the Personal Information Protection Commission, and the Seoul Administrative Court. However, industry insiders argue that such judgments could effectively render existing legal provisions permitting information outsourcing meaningless, which would be a contradictory outcome.

An industry official said, "As far as we know, there are no new issues in the police investigation beyond the legal disputes over information outsourcing and provision to third parties that have already been raised by the financial and data protection authorities. Imposing triple sanctions by multiple agencies using almost identical reasoning for the same information leakage case is excessive. There is also growing dissatisfaction within the industry that the entire business system based on information outsourcing might need to be changed."

Fintech Growth Engine Weakening... Concerns Over Regulatory Tightening Becoming Reality

Industry insiders are concerned that if the standoff between major fintech firms and government authorities continues, regulations on information outsourcing businesses and internal controls could become even stricter in the future.

There are opinions that this could impede the launch of new businesses. For example, when partnering with highly skilled external companies to pursue new businesses such as stablecoins, if the entrusted information is used in the partner’s proprietary model, there is a growing risk of being hit with heavy fines running into billions of won and corrective orders.

There are also concerns that decision-making could become more cumbersome and the scope of data utilization could shrink. For instance, even when carrying out legitimate business activities such as credit evaluation or asset management services using generative artificial intelligence (AI), companies may have to introduce additional consent procedures or voluntarily reduce the scope of data utilization to prepare for the possibility that the authorities could interpret these activities as 'provision of information to third parties.'

There are further concerns that the launch of innovative services could be delayed. If legal reviews during the launch of new services drag on and internal control costs surge, the overall pace of launching innovative services could slow down.

Another industry official said, "There are quite a few small businesses in the industry that cannot even meet the minimum capital requirement of 500 million won for the MyData business. If the trend of treating IT outsourcing contracts with third parties—especially overseas companies—as a problem continues to spread, the new business growth engine could be significantly weakened."

This content was produced with the assistance of AI translation services.