180 incidents on record · 2026 Headlights Incident reports by Ellie Harris · Melbourne
10 new this week Library last updated 30 August 2026
← The incident library
HD-INC-123
Financial technology and payments · South Korea · 2025 · Data taken without consent to build a scoring model

South Korea's privacy regulator fined Kakao Pay after finding it had sent about 40 million users' data to Alipay without their consent, where it was used to build a scoring model, and it ordered the model deleted

By Ellie Harris · Filed Data transferred from 2018; PIPC decision 23 January 2025

Alleged: Kakao Pay; Alipay (Ant Group); Apple developed or deployed the AI system implicated in this incident. Details are drawn from public reports; parties are presumed innocent of any wrongdoing not established by an official finding.

South Korea's privacy regulator fined Kakao Pay after finding it had sent about 40 million users' data to Alipay without their consent, where it was used to build a scoring model, and it ordered the model deleted

What happened

It was reported that in January 2025 South Korea’s Personal Information Protection Commission, the PIPC, fined the payments company Kakao Pay and also penalised Apple, after finding that Kakao Pay had sent the personal information of about 40 million of its users to Alipay, the payments arm of China’s Ant Group, without a legal basis and without asking the users. The commission found the data included phone numbers, email addresses, account balances and other details, that it spanned two dozen categories, and that it had been sent from 2018 onwards. Fewer than one in five of the affected users had registered for Apple Pay, the service the arrangement was meant to support.

It was reported that, according to the commission, Alipay used the data to build what was called an NSF score, a figure between zero and one hundred that estimated the chance a customer would run short of funds during a run of small payments, and that this was done to support Apple Pay without the users being told. The PIPC treated the transfer as an unlawful movement of personal data out of the country. In a step it does not often take, it ordered that the scoring model built from the data be deleted, not only the data itself. Kakao Pay said it believed the transfer was necessary to keep payments secure and that it would review its practices. It was noted that the order stood out because the regulator reached past the data to the model trained on it.

What an auditable version would have shown

The users had no way to know their data had left Kakao Pay, crossed a border, and gone into a scoring model for a different company’s product. An auditable version records, at the point data leaves, what left, where it went, and on what basis, so a transfer like this is either stopped because it has no lawful ground or is logged in a way a regulator can later read. It also ties the model back to the data it was trained on, so if the data turns out to have been taken without consent, the reach of the problem, which model and built from what, is a matter of record rather than a later reconstruction.

Where the gap was

Personal data moved out of the company, across a border, and into a scoring model, and none of that was visible to the people it belonged to or, until the regulator looked, to anyone outside. An EgressGate checks, at the moment data would leave, what it is and whether the destination is one the user’s consent and the law allow, so a transfer without a lawful basis is caught where it happens rather than years later. A ConductRecord keeps what left and where it went, so the path the data took can be read back. When a record ties a model back to the data it was trained on, a regulator can reach the model itself, not just the raw data. Here the commission had to work that link out for itself before it could order the model deleted.

What governance should have looked like

Most data protection laws, Korea’s own among them, already restrict moving personal data out of the country without a lawful basis and, in many cases, the person’s consent. Where a company holds data that people gave it for one purpose, that data should not cross into another company’s model, still less across a border, without a lawful basis and the people being told, and there should be a check at the point the data would leave that enforces this. Best practice would be for a payments company to record every transfer of personal data out of its systems, what was sent and to whom and on what ground, and to keep the link between any model and the data it was built on, so a model trained on data taken without consent can be found and, if a regulator requires, deleted. The commission did require deletion here. It could do so only after establishing what had been sent and what had been built from it.

Failure Pattern: personal data given for one purpose was moved to another company, and across a border, to train a scoring model without the people’s consent, and the transfer was visible to no one outside the companies until a regulator looked.

Governance Principle: personal data must not leave for another party or purpose without a lawful basis and notice, a check at the point of egress must enforce that, and every model must stay linked to the data it was trained on so unlawfully built models can be found and deleted.

The reference implementation of EgressGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.

Sources

The mailing list

Fresh incident reports every week. One email to match.

We add new incidents to the library regularly, and send a single short email each week with what's new. The library stays free and open; this is just how you keep up with it.

No tracking. Unsubscribe in one click.

The record

An auditable system would have produced a signed, tamper-evident record the moment this happened: what the system did, the version that did it, the basis it acted on, and the action taken, and Kakao Pay; Alipay (Ant Group); Apple could have produced it on demand.

This is the record the system as deployed did not produce in a signed, auditable form.

What this teaches
Capture what happened when it happens
What the system did, the version that did it, the basis it acted on, and the action taken, recorded at the moment, not reconstructed after.
Sign it, so no one has to trust the record-keeper
A tamper-evident entry. Edit it later and the signature breaks. The record does not ask for the benefit of the doubt.
Make it verifiable by anyone
A court, a regulator, a customer's lawyer can check the record themselves, without taking the company, or us, at our word.

Headlights summarises publicly reported AI incidents. All summaries are independently written, attributed to their original sources, and intended for research and educational purposes. Allegations are identified as such until established through official findings.

This report is based on the sources listed above and reflects information available at the time of review; later developments may not be captured. Where a person is described as charged with or alleged to have done something, that allegation is unproven unless a conviction or a court or regulatory finding is stated. Headlights publishes journalism and commentary, not legal advice.

Want to write back?

Direct to my inbox.

ellie@useheadlights.com →