Police have launched a full-scale investigation into KakaoPay, which is accused of transferring tens of millions of customer records to China's Alipay.
The Gyeonggi Nambu Provincial Police Agency said Thursday that it recently received a referral from the Financial Supervisory Service (FSS) and began investigating the case last month after assigning it. The agency has booked KakaoPay as a corporation on suspicion of violating the Credit Information Act and is currently conducting its probe.
According to the FSS investigation, KakaoPay transferred a total of 54.2 billion records of personal credit information — covering a cumulative 40.45 million people — to Alipay, which was commissioned by Apple, without customer consent between April 27, 2018, and May 21, 2024. The information passed to Alipay reportedly included encrypted mobile phone numbers, email addresses and charged balances, as well as sensitive electronic financial transaction data such as merchant payment records.
Article 32 of the Credit Information Act requires credit information providers and users to obtain individual consent from the data subject in advance each time they provide personal credit information to a third party. Article 26 of the Electronic Financial Transactions Act stipulates that when performing duties related to electronic financial transactions, personal details, accounts, access media, and transaction content or records of users must not be provided to third parties without user consent. The FSS concluded that KakaoPay violated both laws.
The FSS also determined that KakaoPay's executives and staff failed to conduct checks on compliance with regulations and did not follow administrative security measures. A total of 40.9 billion records of personal credit information were provided between October 2020, after a credit information management and protection officer was designated, and May 21, 2024. Accordingly, the FSS in February imposed heavy sanctions on KakaoPay equivalent to an "institutional warning," along with a fine of 12.976 billion won and a penalty of 4.8 million won.
The case was first disclosed in August 2024 through an FSS announcement, and the civic group Jayu Daehan Hoguk-dan filed a complaint against KakaoPay's management with the Seoul Central District Prosecutors' Office.
Earlier, in January last year, the Personal Information Protection Commission also imposed a fine of 5.968 billion won and a corrective order on KakaoPay over the same matter. KakaoPay filed an administrative lawsuit in April of that year seeking to suspend the effect of the fine. KakaoPay maintains that it transferred encrypted information in accordance with lawful procedures to prevent fraudulent transactions when providing simple payment services on Apple's App Store.
