Coupang: "Facts Not Fully Considered"...Plans Administrative Lawsuit

Personal Information Protection Commission Imposes Record Fine of Over 600 Billion Won, Coupang Expresses Regret

Legal Action Planned After Reviewing the Decision

Fine to Be Reflected as Second-Quarter Loss

Higher Fine Compared to Similar Incidents Domestically and Internationally

Concerns Raised Over Fairness

The Personal Information Protection Commission has imposed a record-high fine and penalty totaling over 620 billion won on Coupang for a large-scale personal information leakage incident that exposed more than 37 million records last year. In response, Coupang has stated that it will seek to clarify the facts through legal procedures, claiming that its proactive measures to prevent secondary damage and its explanations were not adequately considered in the commission's decision.

A Coupang delivery vehicle is parked in a downtown parking lot. Photo by Yonhap News Agency

On June 11, Coupang issued a statement regarding the Personal Information Protection Commission’s announcement of “sanctions against Coupang and its affiliates for personal information leakage and violations.” The company expressed regret that “proactive measures taken to prevent secondary damage and explanations based on clear facts regarding last year’s data leak were not sufficiently reflected in the commission’s decision.”

The Personal Information Protection Commission, during its plenary session held the previous day, concluded that Coupang was responsible for the leakage of personal information of approximately 37.55 million people due to fundamental deficiencies in basic safety management systems, such as poor management of authentication signing keys and insufficient access controls. This figure is about 3.8 million higher than the 33.76 million previously reported by the Ministry of Science and ICT’s joint public-private investigation team.

Sungkyeong Hee, Chairperson of the Personal Information Protection Commission, announced on the 11th at the government complex in Jongno-gu, Seoul, during the full meeting results briefing, that a record-high fine of 624.6 billion won was decided against Coupang for a massive personal information leakage incident. Photo by Jo Yongjun

Accordingly, the commission decided to impose a fine of 423.575 billion won on Coupang for causing the massive personal information leak. In addition, it imposed a penalty of 16.8 million won for violating obligations to notify and destroy leaked personal information. Separately, the commission imposed an additional fine of 201.106 billion won on Coupang for allegedly collecting records of users’ online activities on other platforms without legal grounds such as user consent. Moreover, Coupang’s logistics subsidiary, Coupang Fulfillment Services (CFS), was fined 220 million won after it was found to have collected personal information of police reporters and registered them on employment restriction lists without legal grounds. In total, the fines and penalties imposed on Coupang by the commission amount to 624.9 billion won.

Coupang plans to review the commission’s written decision and clarify the facts through administrative litigation. Separately, the company will reflect the fine as a loss in its second-quarter results this year. An industry official explained, “The general principle is to immediately reflect government-imposed fines in financial results upon official announcement, to prevent misleading investors.” Previously, in August 2024, Coupang was sanctioned by the Fair Trade Commission with a fine of 162.8 billion won for allegedly manipulating algorithms to favor its private brand (PB) products and instructing employees to write product reviews. Coupang reflected that fine as a loss in its second-quarter results that year and is currently pursuing administrative litigation regarding the matter.

Regardless of litigation, Coupang stated, “We apologize for causing concern to our customers and the public due to this personal information leak incident. We will strengthen our personal information protection framework and strive to restore customer trust with renewed determination.”

Meanwhile, the approximately 423.6 billion won fine imposed on Coupang for the personal information leak is expected to spark debate over fairness, as it is significantly higher than similar cases both domestically and internationally. Globally, the company receiving the largest government fine for a hacking-related leak was Meta, which was fined 265 million euros (about 380 billion won) by Ireland’s Data Protection Commission after a 2021 hack of 533 million records. Even though companies like Equifax in the US (which leaked information on 147 million people, fine of about 118 billion won) and hotel chain Marriott International (327 million records, fine of 97 billion won) exposed more personal information than Coupang, their fines were lower. In Korea, SK Telecom was fined 134.8 billion won by the Personal Information Protection Commission last year for a personal information leak affecting 23.24 million people.

This content was produced with the assistance of AI translation services.