Facts
Kakao Pay was a payment option on Apple's App Store, and Alipay worked for Apple. From 2018 Kakao Pay sent Alipay 24 data items, including hashed customer IDs, phone numbers and email addresses as well as balances and payment counts, on some 40 million users, even those who had never registered with Apple and Android users; the cumulative total reached about 54.2 billion records. Alipay used the data to calculate a per-user non-sufficient funds (NSF) score estimating the risk of insufficient funds and supplied it to Apple. At its plenary meeting on 22 January 2025 the Personal Information Protection Commission (PIPC) imposed a KRW 5.968 billion penalty surcharge on Kakao Pay and ordered Alipay to destroy the scoring model. Kakao Pay sued, arguing that it had merely outsourced processing.
Question
The dispute turned on whether sending the data to Alipay was outsourced processing on Kakao Pay's behalf, which needs no user consent, or a provision to a third party and an overseas transfer, which does. The court examined whether the parties had the documents and disclosures that the Personal Information Protection Act (PIPA) requires for outsourcing. It also considered whether the consent users gave on joining the service extended to generating a risk score about them for Apple's services, a point of particular weight for people who did not use Apple at all.
Decision
On 11 June 2026 the Seoul Administrative Court's 12th Administrative Division dismissed the claim. It found no genuine outsourcing relationship, since the documents the Act requires had not been drawn up and for about five years Kakao Pay had not disclosed the processor or the outsourced task on its website. The court treated the customer data and the NSF score derived from it as substantively the same information, the benefit of which accrued solely to Apple. Users had consented only to identification, authentication and settlement and could not have foreseen a risk score for Apple, least of all non-Apple users. The KRW 5.968 billion surcharge and the corrective and publication orders were upheld.
Why it matters
At first instance, the judgment drew the line between outsourcing and third-party provision in a global payment chain in the context of automated risk scoring, using the question of whose interests the scoring served as the decisive test. The PIPC's approach, which included ordering the destruction of a scoring model built from data provided without consent, was sustained. The judgment is not yet final.
Related stages
At the same meeting the PIPC also imposed a KRW 2.405 billion surcharge and a KRW 2.2 million fine on Apple. Kakao Pay lodged an appeal on 24 June 2026.