Personal Information Protection Commission levies record 624.68 billion won ($410 million) fine; penalty draws equity concerns among global data breach cases
Coupang Inc expressed regret Thursday over the Personal Information Protection Commission's decision to impose a record fine of 624.68 billion won ($410 million) and signaled it would pursue legal action.
In a statement posted on its website, Coupang Inc apologized to customers and the public for the personal data breach. "We will further strengthen our personal data protection framework and work with renewed commitment to restore customer trust," the company said.
The company added that it "regrets that the proactive measures taken to prevent secondary harm from last year's data breach, and the explanations grounded in clear facts, were not sufficiently reflected in the Personal Information Protection Commission's decision."
Coupang Inc also defended its affiliate marketing program, Coupang Partners, describing it as a platform used by thousands of domestic creators, bloggers and small-business owners to recommend products and earn income. "We use the same affiliate model as other global companies and operate it lawfully while protecting customer data," the company said, adding that it plans to "clarify the facts through legal proceedings after receiving the official written ruling from the Personal Information Protection Commission."
The commission imposed the fine Thursday over the data breach that became publicly known in November last year, citing violations of security obligations and the collection of personal data without legal basis. It also levied a 16.8 million won administrative penalty. The fine is 4.6 times the 134.8 billion won imposed on SK Telecom following last year's SIM card data breach affecting 23 million people — itself a record at the time. The commission separately fined Coupang Fulfillment Services 248 million won for violations related to the collection and use of personal data and the handling of sensitive information.
Some had forecast a fine of up to 1.3 trillion won based on Coupang Inc's sales last year of 45.5 trillion won and the maximum penalty provisions under current data protection law. The actual fine fell short of 1 trillion won, but it approaches the $473 million (approximately 679 billion won) in annual operating profit that Coupang Inc's US-listed parent reported last year.
The penalty is also the largest ever imposed on a global company for a personal data breach. Ireland's Data Protection Commission fined Meta 265 million euros (approximately $305 million, or about 380 billion won) in 2022 after the personal data of 533 million users was hacked. US credit reporting agency Equifax received a $100 million fine (about 118 billion won) in 2017 after the personal data of 147 million Americans — roughly half the adult population — was exposed. Global hotel chain Marriott International was fined the equivalent of about 97 billion won in 2018 following a breach that exposed the data of 327 million guests, including passport numbers.
The ruling is also expected to raise questions about equity with domestic companies. The matchmaking firm Duo, fined 1.2 billion won in April, offers a stark contrast: sensitive personal data — including names, addresses, height, weight, blood type, religion and financial details — of roughly 430,000 people was leaked, and the company drew criticism for failing to notify victims for 15 months, up to the day the fine was announced.
Coupang Inc has emphasized that no secondary harm from misuse of the leaked data has been reported, and that it identified the breach within five months — faster than SK Telecom, which took three years and eight months, and Duo, which took 15 months. Kakao also received a fine of 5.968 billion won last year after transferring the personal data of its entire user base of 40 million people overseas without consent; Kakao had provided user information to Alipay for the purpose of evaluating Apple service users.
Coupang Inc plans to file an administrative lawsuit after reviewing the commission's written ruling. The company is likely to post a loss in the second quarter as well, following a deficit in the first quarter. It swung to a loss in the first quarter, recording an operating loss of about 350 billion won, largely due to a 1.685 trillion won compensation plan announced in connection with the data breach. A prolonged loss could dampen not only its planned logistics investment for nationwide rocket delivery service by 2027 and overseas expansion, but also domestic hiring. Coupang Inc operates more than 100 fulfillment centers across 30 regions nationwide and employs more than 90,000 people.
soho0902@heraldcorp.com
