Coupang Fined Record 624.9 Billion Won: How Was the Penalty Calculated?

Up to 3% of Sales Over the Past Three Years... Maximum Penalty Could Reach 960 Billion Won
4.24 Billion Won Fine for the Data Leak Incident
2.01 Billion Won Fine for Unauthorized Collection of User Activity Records
Revenue from Unrelated Se

Coupang has set a new all-time record after being fined a total of 624.9 billion won by the Personal Information Protection Commission for leaking member personal information. This amount exceeds four times the 134.8 billion won fine imposed on SK Telecom in August last year for its subscriber USIM information leak incident. The fact that the scale of the data breach reached 37 million people and that Coupang failed to establish even basic safety management systems were both reflected in the calculation of the fine.

According to the Personal Information Protection Commission's decision on June 11, the fine imposed on Coupang for the large-scale personal information leak amounts to 423.575 billion won. In addition, a fine of 201.106 billion won was imposed for unauthorized collection of users’ activity records on other online platforms. Furthermore, Coupang's logistics subsidiary, Coupang Fulfillment Services (CFS), was fined 220 million won for placing police press reporters on an employment restriction list, and an additional 28 million won was levied for the use of sensitive employee health information.

Delivery vehicles are parked at the Coupang logistics center in Seocho-gu, Seoul. Photo by Yonhap News Agency

The fine was calculated based on the rule that allows up to 3% of sales from the three years preceding the incident to be imposed as a penalty. According to the Financial Supervisory Service’s Electronic Disclosure System (DART), Coupang’s average consolidated sales in Korea over the past three years (2022–2024) was approximately 32 trillion won. Based on this, the Personal Information Protection Commission could have imposed a fine of up to 960 billion won on Coupang.

The Personal Information Protection Commission explained, “When calculating the fine for a personal information leak, revenue unrelated to the violation is excluded.” In other words, only Coupang’s e-commerce service revenue affected by the breach was used as the basis for the fine. Revenue from the delivery app Coupang Eats and the online video service Coupang Play was excluded from this calculation.

The seriousness of the Coupang breach and efforts to compensate affected users were also comprehensively considered in the fine calculation. The Personal Information Protection Commission stated, “The final fine is determined after aggravating or mitigating factors, including the seriousness of the violation, the scale and impact of the damage to data subjects, cooperation during the investigation, and completion of corrective measures.” While Coupang’s negligence in authentication systems was counted against it, the absence of previous data breach incidents, cooperation during the investigation, and the provision of compensation to users were considered mitigating factors. Coupang provided each affected member with a compensation coupon worth 50,000 won after the incident.

However, as the revised Personal Information Protection Act will not take effect until September 11, punitive fines were not imposed on this Coupang data breach. The incident occurred in November last year, making the revised law inapplicable. The amendment stipulates that companies repeatedly involved in personal data breaches or responsible for large-scale leaks can be subject to punitive fines of up to 10% of their total sales.

This content was produced with the assistance of AI translation services.