SK Telecom and Coupang Personal Data Lawsuits and Dispute Mediation: How Are They Proceeding?

Collective Holds Briefing on Enacting a Class Action Act

Current Collective Dispute Mediation Process Lacks Effectiveness

Mediation, Civil Litigation, and Constitutional Complaint Proceedings Delayed

Need to Introduce Opt-Out Class Actions and Discovery System

A forum was held to share updates on mediation and litigation over the large-scale personal data breaches at SK Telecom and Coupang, discuss problems that have emerged in the process, and propose institutional improvements to provide effective remedies for victims.

The Collective for the Enactment of a Class Action Act for Consumer Protection (the “Collective”), composed of 19 consumer and civic groups, including the Korea National Council of Consumer Organizations, the Citizens’ Coalition for Economic Justice, Lawyers for a Democratic Society, and the People’s Solidarity for Participatory Democracy, held a press briefing titled “How Are Personal Data Lawsuits and Dispute Mediation Proceeding?—Problems with and Proposed Improvements to Procedures for Redressing Personal Data Violations” at Arumdeuri Hall on the second floor of the People’s Solidarity for Participatory Democracy office in Jongno-gu, Seoul, on the morning of the 29th.

From left, Kim Yunjin, coordinator of Participatory Solidarity’s People’s Livelihood and Economic Affairs Team; Choi Howoong, attorney at Deoksu Law Firm; Kim Daeyoon, attorney at The Dream Law Office; Choi Saeyan, attorney at Minbyun’s Public Interest and Human Rights Litigation Center; and Lee Eunhu, attorney at Jihyang Law Firm, attend a press briefing proposing ways to address problems with procedures for redressing personal information violations and improve them at Arumdeuri Hall on the second floor of Participatory Solidarity in Jongno-gu, Seoul, on the morning of the 29th. Participatory Solidarity

At the briefing, attorneys representing victims and handling the proceedings made presentations in turn on four topics, moderated by Kim Yunjin, coordinator of the People’s Solidarity for Participatory Democracy’s Livelihood and Economic Affairs Team: ▲mediation and civil litigation over the SK Telecom personal data breach ▲the Personal Information Dispute Mediation Committee’s mediation of the Coupang personal data breach ▲civil litigation over the Coupang personal data breach ▲a constitutional complaint challenging the forced creation and processing of Connecting Information (CI).

SK Telecom Rejects Mediation Proposal of KRW 300,000 per Person... Only 485 Join Lawsuit as Trial Is Delayed

Choi Howoong, an attorney at Duksu Law Firm handling a damages lawsuit over the leak of personal data belonging to 23 million people in the SK Telecom breach, said that a collective dispute mediation request had been filed with the Personal Information Dispute Mediation Committee on behalf of 3,267 people, and that the committee had proposed that SK Telecom pay KRW 300,000 per person. However, after SK Telecom rejected the proposal, a civil lawsuit was pursued, and Choi said that only 485 people filed damages claims, bearing litigation costs including attorney fees.

“Damages claims are excluded from the scope of class actions, so companies that process personal data can render the entire mediation process ineffective by rejecting a mediation proposal,” Choi said.

He added, “The current collective dispute mediation process is not functioning at all as an effective remedy. There are no institutional measures, such as assigning a lead panel to handle separately filed lawsuits, and the damages lawsuits currently underway are being delayed because not even their first hearings have been scheduled, or because companies are challenging whether plaintiffs have individually authorized representation, despite that having already been confirmed.”

Choi also said, “These limitations exist because class actions and representative actions for resolving collective disputes have not been institutionalized,” and argued that “an opt-out class action system needs to be introduced.”

An opt-out class action system automatically treats victims of the same incident as participants in a lawsuit unless they explicitly declare that they do not wish to be bound by the judgment by filing an exclusion notice. Under the system, victims who win the case can receive compensation. It contrasts with an opt-in system, in which only victims who directly join the lawsuit are parties to it.

Attorney Kim Daeyoon on Coupang Collective Dispute Mediation: “Few Tools to Stop Companies’ Delay Tactics”

Kim Daeyoon, an attorney at The Dream Law Office handling collective dispute mediation before the Personal Information Dispute Mediation Committee over the leak of personal data from 37.55 million Coupang accounts, said, “The current collective dispute mediation process takes as long as civil litigation because of various structural limitations, undermining the system’s original purpose.”

“Under the Personal Information Protection Act, the period for collective dispute mediation is set at ‘within 60 days from the day after the notice period ends.’ However, a proviso allows the committee to extend the processing period by resolution, making extensions routine,” Kim said. “There are no rules governing deadlines for respondents to submit opinions, so there are few tools to stop companies from using delay tactics.”

He added, “There is also no electronic system for processing additional applications to join collective dispute mediation, verifying applicants’ identities, or checking for overlapping mediation proceedings at other institutions, so tens of thousands of cases have to be handled manually.”

“To address these problems, the requirements for extending the deadline by committee resolution and the deadlines for respondents to submit documents and opinions should be strictly limited to prevent trial delays, and an electronic system for filing collective dispute mediation applications using mobile phones or joint certificates should be introduced,” Kim said. “Disputes over overlapping claims should be referred for resolution by the courts in subsequent litigation.”

Choi Ho-ung, an attorney at Deoksu Law Firm, speaks at a press briefing on problems with and proposed improvements to procedures for redressing personal information violations, held on the morning of the 29th at Areumdeuri Hall on the second floor of the People’s Solidarity for Participatory Democracy office in Jongno-gu, Seoul. People’s Solidarity for Participatory Democracy

Coupang Civil Lawsuits Delayed... “Opt-Out Class Actions and Discovery System Needed”

Lee Eunwoo, an attorney at Jihyang Law Firm handling a damages lawsuit over the Coupang personal data breach, said, “The defense has called for the trial to be suspended until administrative sanctions and investigations or trials are finalized, or shifted the burden of proving damages to the plaintiffs. The defense and the court have also demanded proof of litigation authorization and plaintiffs’ personal details, delaying the trial.”

Lee added, “The Personal Information Protection Commission and the Ministry of Science and ICT, which have already investigated the case, are not cooperating with requests to submit materials, while the defendant has rejected the plaintiffs’ application for an order to produce documents, making it difficult to gather evidence.”

Lee argued, “An opt-out class action system is needed to resolve these problems. An opt-in system, under which a judgment is binding only on plaintiffs who join the lawsuit, would encourage defendant companies to adopt trial-delay tactics aimed at causing plaintiffs to drop out.”

Lee called for the introduction of a discovery system to ease the difficulties victims face in meeting their burden of proof due to the noncooperation of relevant agencies and the imbalance in access to evidence. Lee also urged the active application of punitive damages provisions under Article 39, Paragraph 3 of the Personal Information Protection Act when defendant companies fail to cooperate in redressing the harm.

Constitutional Challenge to “Connecting Information” Clause in Network Act Delayed... “Constitutional Court Should Rule Promptly; Institutional Reform Needed”

Choi Saeyan, an attorney at the Public Interest and Human Rights Advocacy Center of Lawyers for a Democratic Society, who is pursuing a constitutional complaint against Article 23-5, Paragraph 1 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, said, “The provision effectively allows Connecting Information (CI), which is like an online resident registration number, to be created and processed without users’ consent, posing a very high risk of personal data breaches and leaks.”

Article 23-5, Paragraph 1 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, titled “Creation and Processing of Connecting Information, etc.,” prohibits identity verification agencies from creating, providing, using, comparing, or linking information that irreversibly encrypts users’ resident registration numbers (Connecting Information) to link the services of information and communications service providers, while broadly allowing exceptions.

The cases in which the law permits the creation or use of Connecting Information include: ▲providing services to securely identify and authenticate users based on information they enter ▲providing e-government services using Connecting Information by administrative and public institutions that hold unique identifying information under the Personal Information Protection Act ▲when a person holding unique identifying information requests the creation and processing of Connecting Information for a data subject who has requested the transfer of personal data, in order to fulfill a legal obligation to transfer personal data under the Personal Information Protection Act ▲when an identity verification agency and the relevant information and communications service provider have jointly obtained approval from the Broadcasting and Media Communications Commission to provide an information and communications service specified by Presidential Decree for which the creation and processing of Connecting Information without users’ consent is unavoidable, in cases where processing resident registration numbers is permitted under the Personal Information Protection Act.

Kim Daeyoon, an attorney at The Dream Law Office, speaks at a press conference on problems with and proposed improvements to procedures for redressing privacy violations, held on the morning of the 29th at Areumdeuri Hall on the second floor of the People’s Solidarity for Participatory Democracy office in Jongno-gu, Seoul. People’s Solidarity for Participatory Democracy

Choi said, “Connecting Information is a key tool for linking the countless pieces of data generated by individual internet service users and reconstructing them in meaningful ways. Yet under the current system, in South Korea, where identity verification is effectively required to use online services, the unlimited use of Connecting Information is effectively compelled.”

He added, “Despite the enormous harm that can result when Connecting Information is leaked or used arbitrarily by companies, review of the provision’s constitutionality has dragged on. Meanwhile, large-scale Connecting Information breaches have occurred frequently, making the infringement of citizens’ right to control their personal information a reality.”

Choi stressed, “The Constitutional Court must clearly determine whether Connecting Information infringes fundamental rights while retaining the uniqueness and immutability of resident registration numbers. Separately, discussions are needed on institutional reform, including improving the unnecessary practice of identity verification and introducing service-specific identifiers.”

This content was produced with the assistance of AI translation services.