Coupang Inc cites operational damage, customer harm

Personal Information Protection Commission says installment payments available

The nameplate of the Personal Information Protection Commission displayed inside the agency's building. [Personal Information Protection Commission]
The nameplate of the Personal Information Protection Commission displayed inside the agency's building. [Personal Information Protection Commission]

Coupang Inc, which was hit with a fine of roughly 620 billion won ($464 million) over a personal data breach and the unauthorized collection of user activity records, argued Thursday that paying the penalty would deal a severe blow to its operations and ultimately harm customers. The Personal Information Protection Commission rebuffed the claim, saying Coupang Inc holds more than 2.6 trillion won in cash and cash equivalents and is fully capable of paying.

The Seoul Administrative Court's First Administrative Division, presided over by Chief Judge Yang Sang-yun, and its Fourth Administrative Division, presided over by Chief Judge Kim Young-min, held back-to-back hearings Thursday afternoon on Coupang Inc's applications to suspend enforcement of the fines while the company pursues separate lawsuits to have the penalties overturned.

The Personal Information Protection Commission had earlier imposed a fine of 423.57 billion won on Coupang Inc in connection with the leak of personal data belonging to 3,750 people. Separately, the commission found that the company had collected and used the online activity records of about 11.17 million users without legal basis and levied an additional fine of 201.1 billion won. The two fines together total 624.67 billion won.

Coupang Inc filed lawsuits seeking to cancel both fines and simultaneously applied for a stay of enforcement.

At Thursday's hearings, Coupang Inc argued that paying the fines would consume nearly all of its cash on hand and cause severe operational damage. Lawyers for the company said that denying the stay would be contrary to the public interest, "because the harm would extend to the countless customers who rely on Coupang for their daily lives."

Coupang Inc also challenged the fairness of how the fines were calculated. The company said rivals such as Naver, which do not use a direct-purchase model, would face fines roughly one-tenth as large for the same profit, and argued that imposing a penalty ten times higher on Coupang Inc simply because of its direct-purchase structure was inequitable.

The commission rebuffed that argument, noting that Coupang Inc still holds more than 2.6 trillion won in cash and cash equivalents even after paying 1.5 trillion won in dividends to its US parent. The commission said cash assets have been growing by hundreds of billions of won each year and that the fines can be paid in six installments over two years, making payment entirely manageable.

The commission also said that while Coupang Inc points to losses in its parent company's consolidated financial statements, losses incurred from expanding into overseas markets such as Taiwan should not be used as a benchmark for assessing the company's ability to pay the fines.

The commission further challenged Coupang Inc's approach to compensating users affected by the data breach, saying the company had offered discount coupons rather than cash payments and that the coupons were limited in both duration and eligibility — making the compensation little different from ordinary promotional activity.

The court said the upward trend in operating profit at Coupang Inc's domestic entity appeared clear and asked both sides to confirm whether the Korean subsidiary's financial position had also deteriorated in the first half of this year.

The two sides also clashed over the unauthorized collection of online activity records. Coupang Inc said it had not used the information for targeted advertising or stored user behavioral data, and that the collection was intended only to verify advertising consent status and handle customer complaints.

The commission rejected that account, saying the data "clearly constitutes personal information because it was collected in a form that allows individuals to be identified," and said Coupang Inc had deliberately configured its systems to collect information that should not have been gathered at all.


hajun825@heraldcorp.com