Korea's Consumer Dispute Settlement Commission, part of the Korea Consumer Agency, ruled that Coupang must compensate affected users ₩100,000 in cash or Coupang Cash for emotional distress caused by a personal data breach — the first time damages liability has been recognized for such a breach in Korea.
A former employee exposed personal data covering 34 million people, including names, email addresses, physical addresses, building entrance codes and order histories. Investigators later confirmed that a hacker exfiltrated data between April and November and misused some of it, which weighed on the severity finding.
Fifty consumers filed for collective dispute settlement on Dec. 8 last year. The commission opened proceedings on April 6 and held sessions on July 10 and 22. The Personal Information Protection Commission had already imposed an administrative fine on Coupang.
Coupang must notify whether it accepts the decision within 15 days of receipt. Settlement decisions are not enforceable without the parties' consent, so what follows — acceptance or litigation — will determine the practical impact more than the ruling itself.
First, a floor now exists for breach costs. Regulatory fines used to be effectively the only line item; per-user damages are now a precedent. The larger the user base, the more directly exposure scale converts into cost.
Second, note the overlap with marketing data. Order history and address are exactly what personalization and delivery optimization run on. The more useful the data, the stronger the incentive to accumulate it — and the worse a breach becomes. That is a concrete reason to revisit retention periods and data minimization.
Third, the vector was an insider. Controls built around external intrusion are not sufficient without access governance and log auditing.
For the broader regulatory trend around platforms, see Korea Bill Would Make Pre-Approval Mandatory for Lending Ads.
The commission ruled Coupang should pay ₩100,000 in cash or Coupang Cash per affected consumer — the first recognition of damages liability for a personal data breach in Korea.
Names, emails, addresses, building entrance codes and order histories, covering about 34 million people.
No. Coupang must respond within 15 days of receiving the decision, and settlement carries no force without the parties' agreement.
To apply what you just read to your own site, start with a free audit of where things are now.
A strategist replies within 24 hours on business days.
Meta has begun alerting advertisers that the Placements option is being removed from ad sets, along with platform exclusions. Another notch of control disappears into automation.
NBT signed an ad server deal with Mobwith to expand into display advertising. What advertisers should check when an 11M MAU reward network starts selling standard display inventory.
Naver display ads reach reporting launched August 12. Here is what it measures, why logged-in-only counting and 10,000-unit buckets matter, and which campaigns are excluded.