What happened
It was reported that in January 2025 South Korea’s Personal Information Protection Commission, the PIPC, fined the payments company Kakao Pay and also penalised Apple, after finding that Kakao Pay had sent the personal information of about 40 million of its users to Alipay, the payments arm of China’s Ant Group, without a legal basis and without asking the users. The commission found the data included phone numbers, email addresses, account balances and other details, that it spanned two dozen categories, and that it had been sent from 2018 onwards. Fewer than one in five of the affected users had registered for Apple Pay, the service the arrangement was meant to support.
It was reported that, according to the commission, Alipay used the data to build what was called an NSF score, a figure between zero and one hundred that estimated the chance a customer would run short of funds during a run of small payments, and that this was done to support Apple Pay without the users being told. The PIPC treated the transfer as an unlawful movement of personal data out of the country. In a step it does not often take, it ordered that the scoring model built from the data be deleted, not only the data itself. Kakao Pay said it believed the transfer was necessary to keep payments secure and that it would review its practices. It was noted that the order stood out because the regulator reached past the data to the model trained on it.
What an auditable version would have shown
The users had no way to know their data had left Kakao Pay, crossed a border, and gone into a scoring model for a different company’s product. An auditable version records, at the point data leaves, what left, where it went, and on what basis, so a transfer like this is either stopped because it has no lawful ground or is logged in a way a regulator can later read. It also ties the model back to the data it was trained on, so if the data turns out to have been taken without consent, the reach of the problem, which model and built from what, is a matter of record rather than a later reconstruction.
Where the gap was
Personal data moved out of the company, across a border, and into a scoring model, and none of that was visible to the people it belonged to or, until the regulator looked, to anyone outside. An EgressGate checks, at the moment data would leave, what it is and whether the destination is one the user’s consent and the law allow, so a transfer without a lawful basis is caught where it happens rather than years later. A ConductRecord keeps what left and where it went, so the path the data took can be read back. When a record ties a model back to the data it was trained on, a regulator can reach the model itself, not just the raw data. Here the commission had to work that link out for itself before it could order the model deleted.
What governance should have looked like
Most data protection laws, Korea’s own among them, already restrict moving personal data out of the country without a lawful basis and, in many cases, the person’s consent. Where a company holds data that people gave it for one purpose, that data should not cross into another company’s model, still less across a border, without a lawful basis and the people being told, and there should be a check at the point the data would leave that enforces this. Best practice would be for a payments company to record every transfer of personal data out of its systems, what was sent and to whom and on what ground, and to keep the link between any model and the data it was built on, so a model trained on data taken without consent can be found and, if a regulator requires, deleted. The commission did require deletion here. It could do so only after establishing what had been sent and what had been built from it.
Failure Pattern: personal data given for one purpose was moved to another company, and across a border, to train a scoring model without the people’s consent, and the transfer was visible to no one outside the companies until a regulator looked.
Governance Principle: personal data must not leave for another party or purpose without a lawful basis and notice, a check at the point of egress must enforce that, and every model must stay linked to the data it was trained on so unlawfully built models can be found and deleted.
The reference implementation of EgressGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- South Korea’s PIPC flexes its muscles: AI model deletion, cross-border transfers and more (IAPP)
- Kakao Pay fined for unauthorised user data transfer (KoreaTechToday)
- Court upholds penalty against Kakao Pay over user data sent to Alipay (Korea JoongAng Daily)