Coupang’s data duties cannot be dismissed with a ‘KRW 5 million versus 400 billion’ comparison

The two amounts do not sit on the scales of the same case

Maeil Business Newspaper says it analysed 70 judgements from 2021–2025 involving leaks of at least 1,000 personal-information records. Of 152 defendants, 59 individuals received fines averaging KRW 4.73 million. Its headline contrasts that average with approximately KRW 423.6 billion in leak-related administrative penalties against Coupang. The first number is not the average punishment of all defendants. The second is not a penalty on the counterpart company in the same cases as those 59 people. The judgement list and coding table were not obtained, so the sample’s representativeness could not be independently assessed.[P1]

ETNews separates approximately KRW 423.6 billion for the leak from approximately KRW 201.1 billion for unauthorised collection of online activity records. The PIPC’s KRW 624.681 billion is the total. Treating Maeil’s figure as an error simply because it differs from that total would be our mistake. The central issue is the comparison of different responsibilities, rather than the arithmetic alone.[P2][P3]

A company can be a theft victim and still owe a duty of protection

The PIPC did not describe Coupang’s offence simply as having been hacked. It identified shortcomings in authentication signing-key management and access controls, as well as notification and deletion duties. Unauthorised collection of activity on other companies’ websites and apps is a separate issue from the leak. These are the regulator’s findings and sanctions. A contested administrative decision must not be described as a final court judgement.[P3]

The maximum penalty of 10% of revenue is not an automatic charge for every incident. The law effective from 11 September sets a ceiling subject to conditions such as severity or repetition. It also provides an exception for leak penalties where required safeguards were fully taken and reductions related to preventive investment. That new ceiling does not explain the June Coupang decision. Removing those conditions would create a false picture of unconditional corporate punishment.[P5][P6]

France’s CNIL also assessed the security, notification and retention duties of FREE and FREE MOBILE separately from attackers’ conduct. The French case does not determine the appropriate Korean penalty. It does illustrate why the existence of an offender does not eliminate the responsibilities of the organisation holding the data.[P7]

The policy argument is clear. Its evidence also deserves scrutiny.

Maeil’s body text does identify failures in security measures as grounds for sanctions. The lawyer it quotes calls for precedents in which properly managed companies are not penalised, as well as confiscation of criminal proceeds. Those points rule out treating the entire article as a blanket demand for corporate immunity. Nevertheless, the link between the headline contrast and proposed technical assistance foregrounds the burden of corporate sanctions.[P1]

An expert’s institutional affiliation is relevant context. Lawyer Ko Hwan-kyung, quoted in the 11 October article, belongs to Lee & Ko. ETNews reported that the firm was retained for Coupang’s separate unauthorised-collection proceedings, while Shin & Kim represented it in the leak-related proceedings. That firm-level connection is worth disclosing. We did not obtain evidence that Ko personally handled the case or intervened in the reporting.[P4][P2][P10]

The counterargument

The concern that excessive penalties could discourage security investment deserves testing. Smaller businesses may also need technical support. Turning that argument into policy requires evidence about investment and finances, the seriousness of violations and the application of reductions. Recovering criminal proceeds and protecting companies’ legitimate defence rights need not weaken protection or remedies for data subjects. The law’s exceptions and reductions are part of what must be examined.[P6]

What affected readers should distinguish

A large administrative penalty is not automatically paid to victims. Sanctions, individual compensation and dispute mediation are separate processes. The June notice inviting additional participants in Coupang group mediation has expired and must not be presented as an open application window. Consult the Personal Information Dispute Mediation Committee’s official guidance or its Korean contact number, 1833-6972, for available procedures. This does not establish eligibility, a right to compensation or an amount.[P8][P9]