South Korean authorities have taken action against Apple South Korea and Kakao Pay following an unauthorized transfer of personal data involving 40 million local users. The Personal Information Protection Commission (PIPC) imposed fines on both companies after Kakao Pay, a subsidiary of Kakao, transferred user data to Apple using Alipay, a China-based firm, as an intermediary without user consent.
The data transfer violated South Korean law, which requires user consent for providing personal information to third parties, especially when moved overseas. The transferred data was reportedly used to process non-sufficient funds (NSF) scores for Apple, a task delegated to Alipay.
Apple’s representatives were questioned during a PIPC meeting but provided limited information. They could not confirm which other countries used Apple’s NSF scores and claimed difficulty in tracking down related emails due to staff turnover. They did not directly address requests to submit related data.
The commission expressed concern over Apple’s lack of responsiveness, questioning the appropriateness of their limited answers. PIPC standing members urged for improved responsiveness from multinational corporations in such inquiries.
Vice Chairman Choi Jang-hyuk said that the commission is working on revising related laws to address these issues.
More here.