Naver Pay, Toss face scrutiny following Kakao Pay’s transfer of customer data to Alipay
The Financial Supervisory Service (FSS), the country’s financial watchdog, is looking into Naver Pay and Toss to determine whether they have transferred personal credit information to third parties without receiving consent from customers.
The move came as the FSS’ recent inspection found that Kakao Pay, the online payment affiliate of the nation’s tech giant Kakao, allegedly leaked extensive personal data of its customers to Chinese mobile payment service Alipay without their consent. Alipay is the second-largest shareholder of Kakao Pay.
“We are focusing on examining whether Naver Pay and Toss have excessively provided personal credit information to third parties in handling overseas payment gateway services, as Kakao Pay did,” an FSS official said.
The financial watchdog is currently examining relevant documents Naver Pay and Toss submitted. If deemed necessary, it plans to carry out on-site inspections.
The scope of the inspections can also be expanded to other payment gateway companies handling overseas transactions.
The FSS said Tuesday its inspection of Kakao Pay’s foreign exchange transactions from May to July found that the firm had shared about 54.2 billion pieces of personal data of some 40.45 million customers with Alipay from April 2018 until recently.
Kakao Pay partnered with Alipay to facilitate payments for the Apple App Store, but according to the FSS, the Korean firm provided extensive information 한국을 on all of its users, including those who had not used its overseas payment services, without obtaining their consent.
The financial watchdog also alleges Kakao Pay, since November 2019, has been providing Alipay with customer information unrelated to order and payment details, such as Kakao account IDs and phone numbers, when domestic customers made overseas payments.
Kakao Pay said that the provision of information to Alipay falls under a credit information processing delegation within a business consignment relationship, which does not require user consent.