Coupang data breach fuels calls to expand class action lawsuits

Delivery trucks are parked at a Coupang facility in Seoul, Sunday. The weekly active users of the Coupang app stood at 29,935,356 in the week of Dec. 1-7, up about 4.1 percent from the week of Nov. 3-9, despite concerns over a recent data breach. Yonhap

A massive customer data breach at Coupang has revived a long-running call to expand the country’s limited class action system beyond the brokerage industry — a reform that experts say is long overdue among developed nations.

The call was renewed not only among citizens but also by President Lee Jae Myung, who on Friday urged the swift introduction of a broader class action system.

"Every Korean has been affected. It makes no sense to ask each victim to file an individual lawsuit," Lee said.

His comments came as public anger mounted over the leak of personal information belonging to 33.7 million Coupang users — roughly two-thirds of Korea’s population of 51.7 million.

Under current Korean law, victims may bring joint civil lawsuits, but only those named as plaintiffs are eligible for compensation even if a case succeeds. That limitation has made legal redress difficult in cases involving widespread data breaches or consumer rights violations, where individual losses are often small.

"Korea and Turkey are the only OECD members that do not operate a comprehensive class action system," attorney Lee Sang-hee of Jihyang Law Firm said. "When the damage is small but victims are numerous, few consumers actually go through the trouble of pursuing compensation."

The lawyer added that the absence of such a system reduces corporate accountability.

"If companies know potential compensation costs are limited, there’s little financial incentive for them to strengthen data protection. A class action system would encourage better compliance and help prevent recurrence."

Since the breach at the e-commerce giant came to light, more than 20 victim-support communities have emerged on online portal sites, with total membership exceeding 400,000. One online group with more than 100,000 members received over 10,000 new posts in a single day from consumers expressing intent to join lawsuits.

Participants hold a press conference to condemn Coupang’s customer data leaks and its neglect of worker safety at the e-commerce giant’s headquarters in Seoul, Dec. 9. Yonhap

Multiple law firms, including Jihyang, Cheong, Daeryun and LKB & Partners, have filed or are gathering plaintiffs for separate lawsuits, representing more than 10,000 consumers to date. Because each claim must proceed independently, the cases could result in inconsistent court rulings and unequal compensation among victims.

"Different courts may reach different conclusions even for the same factual situation," said Kim Joo-young, managing partner of Hannuri Law. "With a class action system, a single decision could apply to all victims, ensuring consistent compensation and saving judicial resources."

Kim noted that Korea introduced its first and only class action mechanism in 2005 for securities-related cases under the Capital Markets Act. But since then, only 12 such cases have been filed, due largely to procedural hurdles and the absence of U.S.-style discovery rules that allow plaintiffs to obtain internal corporate evidence.

"In securities litigation, plaintiffs often lose because evidence is inaccessible," Kim said. "If discovery were introduced — at least for class actions — it would improve fairness and feasibility. In privacy cases like Coupang’s, where damages are relatively uniform among millions, class actions would be even more effective."

Efforts to expand the class action system have repeatedly stalled due to fierce opposition from businesses.

The Ministry of Justice drafted a bill in 2020 to extend class actions to all civil sectors, but the proposal was shelved after strong pushback from business lobbies, including the Korea Chamber of Commerce and Industry and the Federation of Korean Industries. At the time, they argued that "frivolous lawsuits would harm corporate competitiveness and the national economy."

Several lawmakers, including Reps. Back Hye-ryun, Park Ju-min and Jeon Yong-gi of the ruling Democratic Party of Korea, have introduced similar bills in the current session of the National Assembly covering all consumer and personal data breaches. Yet none has advanced beyond committee review as of December.

Civic activists stage a performance in front of Coupang headquarters in Seoul, Dec. 3, demanding an apology and accountability over the e-commerce giant's massive customer data leak. Yonhap

Critics say the lack of legislative movement has left Korea lagging behind other developed countries.

Beyond Korea and Turkey, Switzerland uses a workaround model that allows victims to transfer claims to legal entities, which then sue on their behalf. Most OECD nations, including Japan and all European Union members, have adopted some form of collective redress.

After high-profile scandals such as Volkswagen's "dieselgate" and major tech-related privacy leaks, the EU mandated every member state to implement representative action systems through its 2020 Directive on Representative Actions.

"While other advanced economies have built mechanisms for collective justice, Korea has fallen behind — trapped in old fears that class actions will bankrupt firms," said professor Park Ji-woo, a legal scholar at Korea University. "The Coupang incident shows that the cost of inaction is borne by consumers."

Kim Guk-il, managing partner of Daeryun Law Firm, explains plans to sue Coupang Inc., Coupang’s parent company, during a press conference at the law firm's Manhattan office in New York, Dec. 8 (local time). Courtesy of SJKP LLP

As Korea hesitates, Coupang is facing mounting legal pressure abroad. On Dec. 8, SJKP Law Firm LLP, a U.S. law firm working with Daeryun, said it plans to file a class action lawsuit in a U.S. district court in New York against Coupang Inc., the company’s Delaware-registered holding entity listed on the New York Stock Exchange.

"Coupang is a U.S.-registered company and we will uncover the truth and seek full compensation under the U.S. judicial system," said Kim Guk-il, managing partner of Daeryun. As of Friday, more than 2,000 individuals — including U.S. residents and Korean expatriates — have signed up to join the suit.