Coupang CI. Photo courtesy of Coupang
The Consumer Dispute Settlement Committee has decided that Coupang must compensate affected consumers 100,000 won in cash or 100,000 won in Coupang Cash per person over a large-scale personal data breach, the committee said on the 31st.
In a collective dispute settlement case related to Coupang’s personal data breach, the committee ruled that Coupang must pay each affected consumer 100,000 won in cash or 100,000 won in Coupang Cash.
The case began on December 8 last year, when 50 consumers filed for collective dispute settlement, demanding compensation for damages from Coupang’s personal data breach. After launching the collective dispute settlement on April 6, the committee reviewed precedents and legal principles related to personal data breaches and held two settlement sessions on the 10th and 22nd to prepare a settlement proposal.
The committee cited as key grounds for its judgment that Coupang’s data breach exposed not only general personal information such as names, emails, and addresses, but also information closely tied to individuals’ private lives, including shared entrance passwords and order histories. It also considered that the hacker leaked information over a long period from April to November last year and that the possibility of actual misuse was confirmed, including sending emails directly notifying some customers of the breach.
In addition, although Coupang argued that there was no possibility of further leaks because it had recovered all the leaked personal information and the devices used in the crime, the committee judged that this could not be assumed with certainty. Accordingly, the committee determined that Coupang is liable to pay compensation for the emotional distress suffered by consumers.
The scale of compensation was set at 100,000 won per applicant, taking into account comprehensively that courts have typically recognized around 100,000 won in damages in large-scale personal data breach cases, that Coupang did not submit data on customers’ usage of its own compensation plan, and that the leaked information is highly likely to be misused in individuals’ daily lives. However, to raise the acceptance rate of the settlement, applicants who wish may receive 100,000 won in Coupang Cash instead of cash.
Coupang must notify the committee whether it accepts the settlement proposal within 15 days of receiving the decision. If no separate expression of intent is made, it is deemed accepted, and once the settlement proposal is accepted, it has the same effect as a judicial settlement.
In relation to this, attorney Lee Chul-woo, the lead party representing the applicants in the collective dispute settlement over Coupang’s personal data breach, said, “We plan to convey our acceptance opinion to the committee immediately upon receiving the decision.” He added, “If Coupang does not accept this settlement decision, we plan to proceed with a ‘consumer litigation support application’ to pursue a lawsuit with the help of the Korea Consumer Agency.” In response, Coupang said, “We will review it closely after receiving the settlement proposal from the Consumer Dispute Settlement Committee.”