[Edaily Reporter Kang Min-koo ] Concerns are growing in the fintech industry as the legal battle surrounding the transfer of Alipay data by kakaopay(377300)has expanded beyond sanctions by the Personal Information Protection Commission and financial authorities to include a police investigation.

While the legality of the data transfer method must ultimately be determined by the court, critics point out that the current structure—in which multiple agencies impose sanctions based on different laws regarding the same case—reduces predictability for companies.

kakaopay is accused of providing Alipay with 54.2 billion pieces of personal information belonging to approximately 40 million people between 2018 and 2024, which were then used to calculate Apple’s credit score (NSF). The Seoul Administrative Court recently ruled that the approximately 6 billion won in fines and corrective orders imposed by the Personal Information Protection Commission were lawful, and kakaopay has filed an appeal. The Financial Services Commission has also notified the company of a fine of approximately 13 billion won based on the same matter, and the Southern Gyeonggi Provincial Police Agency is investigating allegations of violations of the Credit Information Act following a request for investigation from the Financial Supervisory Service.

Industry observers believe that a “triple sanction”—in which the Personal Information Protection Act, the Credit Information Act, and criminal proceedings are effectively applied simultaneously—is becoming a reality.

The court will decide the key issue… The remaining challenge is regulatory predictability

The key issue in this case is the legal interpretation of whether the information transferred to Alipay should be considered “outsourcing of business operations” or “disclosure to a third party.”

kakaopay argues that it outsourced the calculation of NSF scores to Alipay and transmitted the necessary data in hashed form. In contrast, the Personal Information Protection Commission determined that the raw data provided to Alipay could be considered normatively identical to the NSF scores provided to Apple, and thus effectively constitutes a “disclosure to a third party.”

Which interpretation is correct will ultimately be determined by the court’s final ruling. However, the industry is unanimous in stating that, regardless of the legal dispute, the current regulatory framework—in which multiple agencies impose separate sanctions on the same matter—poses a greater burden.

“Fintech and AI Collaboration Structures Could Also Be Stifled”

This case is likely to affect not only kakaopay but the data industry as a whole.

If the Personal Information Protection Commission’s interpretation stands, there is a possibility that even common data collaboration structures—where only the final results are provided to client companies while the raw data is processed by external specialized firms—could be interpreted as “provision to a third party.” There are concerns that this could affect all areas of collaboration with external specialized firms, including risk assessment, credit scoring models, fraud detection systems (FDS), and AI model development.

An industry official stated, “Regardless of whether the court rules the practice illegal, companies must simultaneously contend with investigations and sanctions from multiple agencies,” adding, “If this pattern repeats, it could place a significant burden on efforts to launch new services or data-driven businesses.”

“Consistent Standards Needed Rather Than Duplicate Regulations”

Experts point out that while both personal data protection and industrial innovation are important, there is a need for discussion to enhance the consistency and predictability of the regulatory framework.

Jeon Seong-min, a professor in the Department of Business Administration at Gachon University, said, “South Korea faces the problem of multiple laws being applied in an overlapping manner to specific phenomena,” adding, “It is difficult to ignore the fact that companies are struggling due to excessive regulation.”

Citing the example of the European Union (EU), Professor Jeon also highlighted trends such as the postponement of AI law implementation and the reevaluation of how data protection laws are applied. He said, “Strict regulations are having the unintended side effect of stifling not only Big Tech but also startups,” adding, “We must also create an environment where the innovation ecosystem can thrive.”

Professor Chae Sang-mi of the Department of Business Administration at Ewha Womans University also said, “While the Personal Information Protection Act and the Credit Information Act must be strictly adhered to for the protection of private information, improvements are needed if the overlapping application of different legal frameworks places an excessive burden on companies.” She added, “As the legal framework becomes more complex, costs and risks for companies inevitably increase.”

The recent kakaopay incident appears set to serve as a litmus test—not only regarding the level of personal information protection but also determining the extent to which duplicate sanctions for the same issue should be permitted, and how to strike a balance between data utilization and regulation in the age of AI and fintech.