Coupang and KT Personal Data Breach Investigations Concluded: "Appropriate Disciplinary Measures Will Be Taken" (Comprehensive)

Preliminary Notice Sent to Both Companies After Investigation Concludes

Coupang Submits Its Opinion on Disciplinary Action... Sanctions May Be Determined as Early as June

"Collecting KT's Response... Final Decision on Sanctions Expected Soon"

The Personal Information Protection Commission has completed its investigations into the personal data breach incidents involving Coupang and KT. The Commission plans to determine the level of disciplinary action against Coupang as early as June.

On the afternoon of May 12, Song Kyunghee, Chairperson of the Personal Information Protection Commission, announced at a briefing held at the Government Complex Seoul in Jongno-gu, Seoul, that “the investigations into the personal data breaches at Coupang and KT have concluded, and preliminary notifications have been sent.”

According to the Commission’s regulations regarding investigations and disciplinary actions, investigators must provide the parties with a preliminary notice of the proposed measures, based on the investigation report, and allow at least 14 days for them to submit their opinions. The preliminary notice must include the facts that constitute the grounds for disposition, the proposed measures, applicable laws, and the deadline for submitting opinions.

Accordingly, the Commission will collect the responses to the preliminary notice from both companies and then make a final decision on the level of sanctions, including possible fines, at a plenary session.

According to industry sources, the Commission concluded its investigation into Coupang’s personal data breach and sent a preliminary notice, which included violations of the Personal Information Protection Act and the proposed disciplinary actions, to Coupang in early April. Chairperson Song stated, “We are currently reviewing the opinions submitted by the company, and once the review is complete, the matter will be decided at the plenary session,” adding, “We are doing our utmost to ensure that the disciplinary measures correspond to the level of responsibility.”

It is reported that Coupang, in its submitted opinion, expressed that it does not agree with the overall direction of the Commission’s proposed disciplinary actions.

The disciplinary action against KT is also expected to be finalized soon. Chairperson Song commented with regard to KT, “We have issued the preliminary notice and are currently receiving their response,” adding, “Since the investigation is already complete, it should not take much longer to reach a decision on sanctions.”

She also remarked, “We are well aware that this is a matter of great concern and interest, especially since the illegal femtocell (unauthorized micro base station) issue even led to small-value payment fraud. We will work to ensure that appropriate and timely disciplinary measures are taken in line with the level of responsibility.”

The plenary sessions of the Commission are scheduled for the 13th and 27th of this month, but it has been confirmed that the Coupang case will not be brought up at the session on the 13th. Industry observers expect that, given the large volume of Coupang’s submitted opinion, the review process will take considerable time, making it likely that the sanctions will be determined in June at the earliest.

Meanwhile, at a Cabinet meeting on this day, the Commission reported its “plan to transition to a prevention-oriented personal information management system,” and announced that, starting from the second half of this year, punitive fines of up to 10% of annual sales will be imposed for repeated or serious violations of the Personal Information Protection Act.

However, punitive fines cannot be imposed in the cases of Coupang and KT. This is because the special provision for punitive fines will take effect on September 11, and can only be applied to incidents occurring after the effective date. Chairperson Song explained, “The law cannot be governed by emotions alone, so we will make judgments strictly in accordance with legal principles.”

This content was produced with the assistance of AI translation services.