A Coupang delivery truck in Seoul. Photo courtesy of Yonhap News.
Coupang has received a pre-notice of disposition from the Personal Information Protection Commission (PIPC) over a massive personal data breach, indicating that the sanctions process is entering its final stage.
According to industry sources on the 12th, Coupang recently received the pre-notice containing details of the alleged violations of the Personal Information Protection Act and the planned disposition, and requested an extension of the deadline to submit its opinion. The opinion statement submitted by Coupang reportedly conveyed that it has difficulty agreeing with the PIPC’s planned disposition.
Under the relevant regulations, investigators must notify the parties concerned in advance of the planned disposition based on the investigation report, and grant a minimum of 14 days for submitting opinions. The pre-notice includes the facts that form the basis of the disposition, the planned disposition, applicable laws, and the deadline for submitting opinions.
Given this pre-notification procedure, the industry views that the investigation into Coupang’s data breach has effectively entered its final stage. Only the PIPC’s review of the opinion statement and referral to a plenary session reportedly remain.
In particular, some suggest that Coupang could face a record-high fine. Under the Personal Information Protection Act, fines of up to 3 percent of average revenue over the previous three years can be imposed in the event of a personal data breach. Coupang’s parent company, Coupang Inc., posted revenue of approximately 49 trillion won last year, meaning the maximum statutory fine could reach about 1.5 trillion won by simple calculation.
In its annual report filed with the U.S. Securities and Exchange Commission (SEC), Coupang stated, “We believe this incident could result in additional investigations, enforcement actions, or litigation,” adding, “We are unable to reasonably estimate the potential loss or range of loss, and cannot guarantee that our financial condition, operating results, and cash flow will not be adversely affected.”