SEOUL—South Korea's leading mobile payment platform, Kakaopay Corp., is under scrutiny for allegedly providing the personal credit information of its users to China's Alipay without obtaining the necessary customer consent, a breach highlighted by the Financial Supervisory Service (FSS) on Tuesday.
According to Yonhap News Agency, Kakaopay allegedly transferred personal data to Alipay, which is also its second-largest shareholder. The FSS pointed out that under the country's Credit Information Use and Protection Act, any transfer of personal credit information to a third party, especially to a foreign entity, requires explicit customer approval. This rule includes an additional consent for the overseas transfer of such data, which Kakaopay reportedly did not obtain.
Kakaopay has contested these allegations, asserting that there was no illegal transfer of information. The company explained that the data shared with Alipay was solely for the purpose of facilitating mobile payments and was transferred under a consignment contract with both Alipay and Apple Inc. It also emphasized that the information was encrypted, making it impossible for Alipay to either identify the users or use the data for any purpose other than detecting illegal payments.
Despite these assurances, the FSS revealed that since April 2018, Kakaopay had provided details on 54.2 billion transactions involving over 40 million users to Alipay. The shared data included sensitive information such as Kakao account IDs, cellphone numbers, email addresses, and payment details. In over 550 million instances, Kakaopay also transferred credit information of users who made overseas purchases, which the regulator noted was unnecessary for settling such transactions.
The FSS has announced plans to swiftly initiate a sanctions procedure following a thorough legal review and intends to inspect other firms for similar violations, signaling a broader regulatory crackdown on data privacy breaches within the financial sector.