Coupang challenges record W624.7b privacy fine in court

E-commerce giant Coupang has taken South Korea's data protection watchdog to court over a record 620 billion won ($461 million) in fines tied to its massive data leak, sources said Thursday.

The e-commerce giant filed two suits with the Seoul Administrative Court on Wednesday, asking it to cancel the penalties the Personal Information Protection Commission assessed in June. Coupang also sought to halt the fines until the court rules.

The commission ordered Coupang and its affiliate to pay a combined 624.9 billion won, along with 16.8 million won in administrative fines, over a breach of users' personal information that the company disclosed last November.

Investigators counted 33.22 million members and at least 4.33 million nonmembers among the victims, a total that ran 3.88 million higher than the figure a joint public-private team released in February.

The commission blamed the leak on Coupang's failure to put basic safeguards in place, from managing authentication signing keys to controlling system access.

The leak alone drew 423.6 billion won, while another 201.1 billion won targeted other privacy violations, including tracking more than 10 million members' activity on outside sites without consent.

The regulator also fined the affiliated Coupang Fulfillment Services 248 million won for mishandling personal and sensitive information, which is not apparently being challenged at this time.

The fine for the breach marks the largest ever imposed on a single data leak in Korea, and the total is the largest any single company has faced for multiple violations.

"Our preemptive steps to prevent secondary damage from last year's breach and our explanations based on clear facts were not fully reflected in the commission's decision," the company said. "We expect the legal process to clearly establish the facts."