Coupang issues statement Thursday, signals administrative lawsuit; fine called largest ever imposed on a global firm over data breach
Coupang Inc expressed regret Thursday over the Personal Information Protection Commission's decision to impose a record fine of 624.68 billion won (about $410 million) and said it would pursue legal action to contest the ruling.
"Coupang takes the protection of customer information extremely seriously," the company said in a statement. "We regret that the preemptive measures we took to prevent secondary damage from last year's data breach, and our explanations based on clear facts, were not sufficiently reflected in the commission's decision."
Coupang also defended its affiliate marketing program, Coupang Partners, describing it as a platform used by thousands of domestic creators, bloggers and small-business owners to recommend products and earn income. The company said the program operates lawfully using the same affiliate model as other global companies and that customer data is properly protected. Coupang added that it plans to clarify the facts through legal proceedings once it receives the official written decision from the commission.
The Personal Information Protection Commission imposed the fine Thursday, citing violations of mandatory security measures and the collection of personal data without legal basis, in connection with a data breach at Coupang that became publicly known in November last year. The commission also levied a separate administrative penalty of 16.8 million won.
The fine is the largest ever imposed on a global company over a personal data breach. By comparison, Meta was fined 265 million euros (about $305 million, or roughly 380 billion won) by Ireland's Data Protection Commission in 2022 after the personal data of 533 million users was hacked. US credit reporting agency Equifax received a $100 million fine in 2017 following the exposure of data belonging to 147 million Americans — roughly half the country's adult population. Global hotel chain Marriott International was fined the equivalent of about 97 billion won after a 2018 breach that exposed the passport numbers and other personal information of 327 million guests.
The ruling is also expected to raise questions about consistency in how domestic and foreign companies are treated. A frequently cited comparison is Duo, a matchmaking service fined 1.2 billion won in April after the sensitive personal data of roughly 430,000 people — including names, addresses, height, weight, blood type, religion and financial information — was leaked. Duo drew criticism for failing to notify victims for 15 months, up to and including the day the fine was announced.
Coupang has emphasized that no secondary harm from misuse of the leaked data has been reported, and that it identified the breach within five months — faster than SK Telecom, which took three years and eight months, and Duo, which took 15 months.
Kakao was also fined 5.968 billion won last year after transferring the personal data of its entire user base of 40 million people overseas without consent. Kakao had provided the user information to Alipay for the purpose of evaluating Apple service users.
Coupang plans to file an administrative lawsuit after reviewing the commission's written decision. The company is widely expected to post a loss in the second quarter, following a deficit in the first quarter of this year.
soho0902@heraldcorp.com
