Will Punitive Damages Become a Reality in the Coupang Personal Information Leak Incident?

With 2023 Legal Revision, Claims Up to Fivefold Allowed
Punitive Damages Rare in Mass Data Breach Cases
Need for Victim Identification Duty and Class Actions

In light of the Coupang personal information leak incident, the implementation of a punitive damages system has emerged as a key issue. There are very few legal precedents in which claims for punitive damages have been upheld. If a company sells or misuses personal information by providing it to a third party, rather than through a data breach, there is no obligation to notify victims, making it difficult to file claims for damages in the first place.

Punitive Damages Put to the Test for the First Time

Compulsory Compensation Association under the Personal Information Protection Act. Legal Newspaper.

The Personal Information Protection Act allows for compensation of up to five times the actual damages if a personal information handler violates obligations stipulated by law (Article 39, Paragraph 3). In 2016, a provision was introduced allowing for compensation up to three times the damages, and in 2023, a further amendment raised the cap to five times. The burden of proof regarding whether the data leak was intentional or negligent now falls on the data handler, thereby reducing the burden on victims to initiate lawsuits.

Although nearly a decade has passed since the law was enacted, there are hardly any cases where punitive damages have been recognized. In 2016, there was a case where information on 10.3 million Interpark members was hacked by North Korea, but as the incident occurred about two months before the amended law took effect, punitive damages could not be applied.

While the Coupang case is expected to be the first of its kind, it remains uncertain whether punitive damages will be recognized. There have also been rulings that mental distress is not subject to punitive damages. The Incheon District Court stated that while property damage can be calculated with objective evidence, mental damage cannot, making it unclear how many times the compensation should be multiplied. The court concluded that "Article 39, Paragraph 3 of the Personal Information Protection Act should be interpreted as being limited to claims for property damage" (2021Na74344). The court also noted that since all relevant circumstances are considered when determining compensation for pain and suffering, the multiplier is already effectively included.

Is Mental Distress Also Subject to 'Punishment'?

There are additional obstacles. The Personal Information Protection Act waives the burden of proof for damages if it is difficult for victims to assert the amount. Instead, the court sets the amount of damages at up to 3 million won, but does not award punitive damages in such cases (statutory damages, Article 39-2). Compensation for mental distress is often set at less than 3 million won.

In connection with the Coupang incident, several class actions are being pursued simultaneously. The amount of damages per plaintiff is expected to be between 100,000 and 500,000 won. Jung Taewon, attorney at LKB Pyeongsan (Judicial Research and Training Institute Class 33), stated, "We are collecting evidence such as suspicious items being delivered to homes or property damage resulting from the leakage of apartment entrance codes," and added, "We plan to file separate class actions with plaintiffs who wish to claim mental distress damages."

There is also a need to amend the law so that punitive damages can be applied to incidents other than those caused by hacking. Between 2011 and 2014, Homeplus sold 7.12 million cases of personal information to seven insurance companies for 14.8 billion won while enrolling members in its membership card program. Investigations revealed that half of the victims had not consented to the provision of their information to third parties. In May 2024, the Supreme Court recognized compensation for pain and suffering ranging from 50,000 to 300,000 won for only four out of approximately 280 membership card holders who filed a claim for damages against Homeplus (2018Da262103).

At the time, the Supreme Court ruled that while the defendant bears the burden of proving whether the data leak was intentional or negligent, the plaintiff must prove that the damage occurred in the first place. The Personal Information Protection Act stipulates that victims must be notified without delay if a data leak is discovered (Article 34). Since Homeplus did not experience a data breach but rather intentionally used the information, it was not obligated to notify victims. Without the assistance of investigative agencies or the defendant, Homeplus, it was impossible for victims to know about the incident. This led to strong criticism since the first trial, but no improvements have been made to the system.

Jung Sejin, attorney at Yulchon (Bar Exam Class 3), stated, "It should be possible to claim damages even when personal information is provided to third parties without notification of the damage." Jung added, "The misuse of personal information beyond the scope for which customers consented, such as for marketing purposes, also infringes on the rights of data subjects. Although the damage may be smaller than in the case of third-party leaks, the system needs to be improved so that victims can be made aware of such incidents."

The Need for a 'Korean-Style Class Action'

The lack of a class action system is another issue that needs to be addressed. In a class action, if a small number of representatives win, the legal effect applies to others who did not participate in the lawsuit. While the Personal Information Dispute Mediation Committee can provide the effect of a class action if mediation is reached (Personal Information Protection Act Article 49), companies can refuse to accept mediation, limiting its effectiveness.

Reporter Park Seongdong, Legal Newspaper

※This article is based on content supplied by Law Times.

This content was produced with the assistance of AI translation services.