Coupang sues Korea's privacy regulator to cancel its record 624.7 billion won fine

Coupang averaged about 36 trillion won in annual sales over the past three years, Yonhap reported ^[11], so the 624.7 billion won it wants cancelled comes to roughly 1.7% of a typical year ^[17]. The breach portion alone is about 1.2% ^[18]. Korea's privacy law allows a leak fine of up to 3% of annual sales and lets sales from businesses unrelated to the violation be excluded ^[10]. Applied to the full 36 trillion won, that ceiling is about 1.08 trillion won ^[19], and the breach fine uses about 39% of it ^[20].

That 39% is a floor. The reports do not say which of Coupang's sales the commission counted, and any revenue it set aside as unrelated shrinks the ceiling and puts the fine closer to it ^[10]. A platform with a tenth of the sales and the same leak would face a ceiling a tenth the size ^[10].

Coupang's statement argues facts and mitigation. "Our preemptive steps to prevent secondary damage from last year's breach and our explanations based on clear facts were not fully reflected in the commission's decision," the company said. "We expect the legal process to clearly establish the facts." ^[9]

The two reports also differ by 0.2 billion won. The components sum to 624.7 billion won ^[14], the figure Yonhap uses ^[2]. The Korea Herald gives a combined 624.9 billion won for Coupang and its affiliate, plus 16.8 million won in administrative fines ^[3]. It separately reports a 248 million won fine on Coupang Fulfillment Services, a fine Coupang does not appear to be challenging ^[15]. Adding that fine to 624.7 billion won gives 624.948 billion, or 624.9 billion rounded ^[16]. The piece Coupang is leaving alone is about 0.04% of the piece it is fighting ^[23].

The court could refuse the stay and uphold the fines, and the breach portion becomes the reference price for a Korean leak at this scale. It could grant the stay ^[7] and uphold later; the price holds and only the payment date changes. Or it could cut the breach portion on the safeguard findings over signing keys and system access ^[8]. In that case the 201.1 billion won for other violations, including tracking more than 10 million members on outside sites without consent, rests on separate conduct ^[4].

I think the ruling will set the benchmark for large platforms, because no single leak in Korea has drawn a bigger fine ^[6]. The counter-case is that the facts are Coupang's alone: a breach reported belatedly last November ^[12], a victim count that ran 3.88 million above a February public-private tally ^[5], and some U.S. officials and lawmakers questioning whether the Korean unit of U.S.-listed Coupang Inc. was treated unfairly ^[13]. If the court rules on those specifics and leaves the sales base untouched, other operators learn little about their own exposure, and this view is wrong.