South Korea Fines Coupang Record $4.3 Billion for Massive Data Breach

(CNA Reporter Yang Qifang, Seoul, 11th Special Dispatch) South Korea's Coupang experienced a massive personal data breach late last year. The Personal Information Protection Commission (PIPC) announced today that it has fined Coupang over 624.6 billion won for leaking the personal information of 37.5 million people and illegally collecting the online activity records of its members.

According to Yonhap News and Dong-A Ilbo, the PIPC held a plenary session yesterday at the Government Seoul Complex to deliberate on the disciplinary action against Coupang for violating its duty to safeguard personal information.

The PIPC decided to impose a fine of 624.681 billion won (approximately NT$13.88 billion) and an additional penalty of 16.8 million won (approximately NT$373,000) on Coupang. Of this, approximately 423.6 billion won was fined for the data leak. Approximately 201.1 billion won was fined for illegally collecting the online activity records of over 10 million members.

This is not only the highest fine ever imposed for a single data breach in South Korea but also the highest total fine for multiple violations by a single company.

The PIPC determined that Coupang had deficiencies in its basic security management system, leading to the leak of personal information of approximately 37.5 million people. The investigation also revealed that Coupang violated its obligations to report and destroy leaked data, failed to ensure the independence of its Chief Privacy Officer (CPO), and obstructed the investigation.

The PIPC ordered Coupang to strengthen security measures to prevent recurrence, notify non-members of the data breach, and ensure the CPO can perform duties effectively. Additionally, the commission recommended improving the data processing mechanism for withdrawn members and will verify implementation and improvement results within three months. (Editor: Zhou Yongjie) 1150611