South Korea PIPC Pioneers "Model Deletion" Remedy in Landmark Kakao Pay/Alipay Cross-Border Enforcement Action

In a groundbreaking regulatory enforcement action, South Korea’s Personal Information Protection Commission (PIPC) has established a major global precedent for how cross-border data transfer violations are penalized, introducing "model deletion" (or algorithmic disgorgement) as a remedy.

The Kakao Pay, Alipay, and Apple Case (January 2025)

On January 23, 2025, the PIPC imposed a combined administrative fine of KRW 8.37 billion (approximately USD 5.8 million) on Kakao Pay and Apple for unauthorized overseas transfers of personal data:

• Kakao Pay was fined KRW 5.97 billion for transferring the personal data of approximately 40 million users to Alipay without obtaining user notice or consent, and without establishing valid cross-border transfer mechanisms. The transferred data included information of users who had never registered Kakao Pay as a payment method on an Apple device (such as Android users).
• Apple was fined KRW 2.40 billion for failing to disclose Alipay as an overseas trustee/subcontractor for processing personal data within its App Store payment system.

The "Model Deletion" Precedent

While the financial penalties are substantial, the most significant aspect of the ruling is the corrective order issued to Alipay. Alipay had used the unlawfully transferred Kakao Pay user data to generate "Non-Sufficient Funds (NSF)" scores and build an AI-driven credit/payment data model for Apple Pay.

The PIPC ordered Alipay to delete the algorithm and data models trained on the unlawfully obtained Korean user data. As highlighted by the International Association of Privacy Professionals (IAPP):

"The 2021 Scatter Lab case confirmed the Personal Information Protection Act's reach into AI training data, but the January 2025 Kakao Pay decision brought teeth. After finding the wallet provider sent 40 million users' data to Alipay, which in turn built "NSF scores" for Apple Pay without notice or consent, the PIPC not only levied KRW8.3 billion in fines — it ordered Alipay to erase the algorithm itself."

This "model deletion" remedy represents a significant shift in global privacy enforcement. While European and U.S. regulators have historically focused on deleting underlying datasets, South Korea’s PIPC has shown a willingness to target the "crown jewels" of AI developers—the trained models themselves—when the training data is sourced in violation of cross-border transfer and consent rules.

Mutual Recognition of EU Standards (September 2025)

In a separate positive development for cross-border data flows, on September 3, 2025, the PIPC formally recognized the European Union's data protection standards as equivalent to South Korea's. This mutual recognition framework facilitates safer and more seamless cross-border data transfers between South Korea and the EU, reducing compliance friction for multinational companies operating across both jurisdictions.