Coupang hires firm with ex-privacy watchdog chief as it braces for record $410M fine fight

Coupang Inc., hit with a record 624.7 billion won fine by South Korea's Personal Information Protection Commission, is mounting an aggressive legal defense ahead of an expected administrative lawsuit — retaining law firms that include former senior officials of the very regulator it is fighting.

The e-commerce giant has already hired Bae, Kim & Lee LLC, known as Sejong, where the commission's inaugural chairperson serves as an adviser. Kim & Chang is expected to join as co-counsel. Both firms have former high-ranking commission officials on their rosters.

The moves have drawn fire over the revolving-door culture surrounding the commission. As data breaches multiply and enforcement actions against companies increase, critics warn that former officials acting as legal shields for defendants could undermine the effectiveness of regulatory sanctions.

Coupang retained Sejong to handle the administrative lawsuit contesting the fine, and Kim & Chang — which represented the company during the deliberation and resolution process — is also expected to come on board as litigation counsel.

At the commission's full plenary session on Wednesday, Coupang presented its defense through both firms, addressing alleged violations related to security safeguards and the unauthorized collection of users' online activity records.

Immediately after the commission announced the fine, Coupang said it expected "the facts to be clearly established through legal procedures" once it received the official resolution, signaling its intent to pursue an administrative lawsuit.

The choice of counsel has prompted industry observers to question whether Coupang is counting on preferential treatment from former insiders. Both firms employ ex-commission officials.

At Sejong, Yoon Jong-in — who served as the commission's first chairperson starting in August 2020 — works as an adviser. He left the post on Oct. 7, 2022, and received approval to take the private-sector position in January 2024, less than two years after his departure.

Kim & Chang also counts a former senior commission civil servant among its ranks. A former director of the commission's personal data protection policy division — a Grade 3 official — retired in July 2023 and received clearance to join the firm just two months later, in September of that year.

Kim & Chang's reach in commission-related litigation is particularly notable: the firm handles 10 of the 26 cases the commission has been involved in over the past five years as of July 31 last year. The firm also represents SK Telecom in its administrative lawsuit challenging what had been the previous record fine of about 134.8 billion won (approximately $88.5 million).

Concerns have emerged that former commission officials at the retained firms could influence the outcome of litigation. Commission Chairperson Song Gyeong-hee shrugged off the criticism, saying the agency would "respond actively if a lawsuit is filed" and that the sanctions were "a justifiable disposition reached after careful deliberation based on law and principle."

Meanwhile, the total fine of 624.68 billion won breaks down into 423.575 billion won for violations of mandatory security safeguard obligations and 201.106 billion won for the unauthorized collection of Coupang members' third-party online activity records through its affiliate program Coupang Partners.

The penalty is the largest ever imposed by the commission for a personal data breach. The previous record was the 134.8 billion won fine levied against SK Telecom over the leak of SIM card information.