The text message Coupang earlier sent to affected customers notifying them of the personal data breach. Yonhap News
The Consumer Dispute Settlement Commission has ruled that Coupang must pay 100,000 won in cash or 100,000 won in Coupang Cash in a collective dispute mediation case stemming from last year’s massive leak of personal information at the company.
The commission said on the 31st that it reached the decision after holding two mediation sessions this year to prepare a settlement plan, following an application in December last year by 50 consumers seeking damages over Coupang’s personal information breach. It marks the first case recognizing damages liability for Coupang’s personal information leak.
The parties must notify the commission of whether they accept the terms of the mediation decision within 15 days of receiving the decision, and if the parties accept, it takes effect as a judicial settlement.
The Consumer Dispute Settlement Commission plans to proceed with related procedures, such as requiring the submission of a compensation plan, so that if Coupang accepts this mediation decision, the same compensation can be provided to victims who did not participate in the mediation proceedings.
Earlier, according to the Personal Information Protection Commission, the Coupang hacker was found to have leaked the personal information of 33,222,472 members and at least 4,338,368 non-members. That amounts to about 37.5 million people, and by a simple calculation assuming all of them could receive damages, the total compensation would reach 4 trillion won.
The Consumer Dispute Settlement Commission determined that Coupang bears liability to pay compensation for emotional distress, considering that information closely tied to individuals’ private lives was leaked and the possibility that actual harm could occur.
“We took into account that not only general personal information such as Coupang members’ names, emails and addresses but also information closely tied to individuals’ private lives, such as common entrance-door passwords and order histories, was leaked, and that the hacker leaked information over a considerable period from April to November last year and directly sent emails about the leak to some customers, revealing the possibility of actual misuse,” the commission said.
It added, “Considering that Coupang claims there is no possibility of further leaks because it recovered all leaked personal information and the devices used in the leak, but that this is difficult to conclude with certainty, we determined that Coupang bears liability to pay compensation for the emotional distress of consumers who had used Coupang in various ways in their daily lives.”
Regarding its decision to have Coupang pay 100,000 won in cash or Coupang Cash per person, the commission pointed to the fact that courts have typically set compensation within the range of 100,000 won in large-scale personal information leak cases.
The Consumer Dispute Settlement Commission said, “We took into account various circumstances, including the fact that Coupang did not submit the usage status of the applicants regarding its own compensation plan, and that the leaked information appears highly likely to be misused in the sphere of individuals’ daily lives.”
It added, “In accordance with the opinion of the applicants’ lead representative that an alternative payment method could also be accepted in order to raise the acceptance rate of the mediation, we decided that, if the applicant chooses, they can be paid in Coupang Cash instead of cash.”