Covering the food & beverage industry, beauty, fashion, retail markets, the Ministry of Land, Infrastructure and Transport, the Ministry of Agriculture, Food and Rural Affairs and related people and entities worldwide
Coupang data breach probe likely to conclude as early as June
Coupang's Seoul headquarters in Songpa District / Yonhap
By Ko Dong-hwan
Penalty could reach as high as $991 mil.
The government is expected to conclude its investigation into a massive data breach at Coupang early next month and issue its final ruling, including the size of any fine to be imposed on the e-commerce giant.
The Personal Information Protection Commission (PIPC), under the Office for Government Policy Coordination, completed its investigation, determined the level of penalty and sent an advance notice of disposition to Coupang in early April, industry sources said Tuesday.
The notice is part of due process under PIPC regulations, which require authorities to give the subject of an investigation at least 14 days to review the proposed penalty and submit feedback and supporting materials. Coupang reportedly requested a deadline extension, which the commission granted.
An advance notice of disposition typically includes sanctions and penalties to be imposed, the reasoning behind it, relevant legal provisions and the deadline for submitting its response, but not the exact amount of fines.
The company recently submitted its feedback, in which it objected to most of the proposed penalties and the authority’s reasoning.
Speculation suggests the PIPC is unlikely to conclude the case this month due to the large volume of materials submitted by Coupang as part of its defense. Considering the PIPC previously indicated it would conclude the case within the first half of the year, it is highly likely that the decision will come in June.
A protester accusing the U.S. government of intervening in Korean authorities' scrutiny into Coupang's data breach and other allegations wears a paper mask featuring company founder Kim Bom-suk in front of the U.S. Embassy in Seoul, April 30. Yonhap
After the data breach that affected tens of millions of Coupang users was disclosed in November, speculation mounted that the company could face an unprecedentedly high fine for mismanaging confidential data. The country’s Personal Information Protection Act allows authorities to impose penalties of up to 3 percent of a company’s average annual sales over the past three years in such cases.
Coupang’s New York Stock Exchange-listed parent company, Coupang Inc., posted 49 trillion won ($33 billion) in sales last year, putting the theoretical maximum penalty at 1.47 trillion won.
Industry experts, however, say this figure is unrealistic, noting that the calculation would exclude revenue from business segments deemed unrelated to the data breach. The largest fine imposed by the PIPC so far was 135 billion won on SK Telecom last year over a data breach.
Coupang is also facing tensions with the Korean government after its founder Kim Bom-suk was designated last month as the company’s “same person” — a legal term referring to an individual who effectively controls a conglomerate. Someone designated as the same person is subject to tighter oversight, including disclosure requirements for intra-family transactions and rules governing holding company structures.
According to Coupang officials, the company filed a lawsuit with the Seoul High Court on Friday seeking to overturn the Korea Fair Trade Commission’s designation of Kim, also known as Bom Kim, as its “same person.”
Previously, the company itself — rather than an individual — had been designated as the de facto controlling entity. The commission, however, said Coupang no longer meets key conditions for the exception, citing that Kim’s younger brother, Kim Yoo-seok, is effectively involved in management as a vice president of the company.