"Coupang Must Pay 420 Billion Won"... Court Keeps 'Personal Data Leak' Fine in Effect

Monetary compensation deemed possible
Corrective and disclosure orders suspended until 30 days after judgment in the main lawsuit

Coupang, which was fined more than 420 billion won over a massive personal data breach, asked the court to suspend the effect of the penalty, but the request was not fully granted.

Coupang headquarters in Gwangjin-gu, Seoul. Reporter Yoon Dongju.

The Seoul Administrative Court's Fourth Administrative Division, presided over by Judge Kim Young-min, partially granted on the 5th Coupang's request to suspend enforcement, filed against the Personal Information Protection Commission (PIPC). The court granted the request to suspend enforcement of the corrective order and publication order issued by the PIPC, but rejected the request to suspend enforcement of the fine of 423.575 billion won.

A stay of enforcement is a measure that temporarily suspends the effect of an administrative disposition while a lawsuit seeking its cancellation is pending. The fine remains in effect because the court rejected the request to suspend enforcement of that disposition.

The court ruled that Coupang's losses from the fine could be compensated monetarily later and therefore would not constitute irreparable harm. It also found that the materials submitted by Coupang did not sufficiently demonstrate the need to urgently suspend the effect of the disposition.

However, the effect of the corrective order and publication order issued by the PIPC has been suspended for now. As a result, Coupang must pay the fine, but may defer compliance with the corrective order and other measures until the merits lawsuit is decided. The court found that the disposition could cause Coupang irreparable harm and that suspending its effect was necessary to prevent such harm. It also found that a stay was unlikely to have a significant adverse impact on the public welfare. A date has not yet been set for the first hearing in the merits lawsuit.

Accordingly, the corrective order and publication order will remain suspended until 30 days after the judgment in the merits lawsuit is announced. The corrective order includes ▲strengthening security measures to prevent similar incidents from recurring ▲notifying data subjects who are not members of the breach ▲ensuring that the chief privacy officer (CPO) has a meaningful role.

At a plenary meeting in June, the PIPC concluded that a breach involving the personal data of approximately 37.5 million people had occurred because Coupang failed to meet its obligations to implement security measures for protecting personal data. It imposed a fine of 423.575 billion won and issued corrective orders, among other measures. This is the largest fine ever imposed for a single personal data breach.

Coupang subsequently filed a merits lawsuit seeking to overturn the PIPC's disposition and also requested a stay of enforcement, asking the court to suspend the disposition's effect until a judgment is issued.

Meanwhile, this ruling is separate from the case concerning Coupang's request to suspend enforcement of a 201.106 billion won fine imposed in connection with its collection of users' online activity records.

This content was produced with the assistance of AI translation services.