Why Personal Information Protection Commission Rejected Coupangs Fine Reduction Demands

When compliance failures lead to penalties exceeding historical precedents—such as this fine, which stands at 4.6 times the previous record held by SK Telecom at 1347억9100만원—enterprises must immediately reassess their internal control environments.

Regulatory Rejection of the Net Method and Revenue Calculation Disputes

During the deliberation process documented in the commission’s full meeting transcripts released on September 27, Coupang raised formal objections to the revenue calculation criteria used to determine the penalty. The company argued that direct purchases should be evaluated using the net calculation method. Under this approach, product procurement costs alongside shipping and storage expenditures would be deducted from gross figures.

Coupang reasoned that direct purchase transactions record total sales value, whereas open market platforms record only brokerage commissions. This accounting structure creates a stark disparity in fine assessments despite similar overall transaction volumes and market shares. Coupang representatives noted that comparing 2024 revenues under these diverging frameworks creates a tenfold gap in apparent scale. Commissioner Yoon Young-mi rejected this argument, stating that accommodating the request would destroy consistency with established penalty standards and violate statutory provisions under the Personal Information Protection Act. The commission instead utilized publicly disclosed corporate revenues while excluding non-infringing divisions like Coupang Eats, Coupang Play, and business-to-business operations.

Security Vulnerabilities and the Reclassification of Violation Severity

The regulatory scrutiny intensified over the underlying nature of the security failure. Coupang contended that the incident warranted classification as a ‘weak violation’ because it originated from a former employee’s criminal acts without commercial intent. The firm emphasized its multi-layered security architecture, including ISMS-P certification, alongside customer compensation and remediation efforts.

Investigators dismantled this defense by establishing that the breach stemmed from fundamental safety management failures rather than sophisticated hacking. Unauthorized access exposed delivery management pages roughly 1억4800만회 times across 16 distinct IP addresses. The firm operated authentication signature keys in plain text and maintained lax access controls that left accounts vulnerable. Systems failed to detect the activity for over six months until customer complaints triggered an internal review.

Penalty Adjustments and Corporate Legal Strategy

The Personal Information Protection Act mandates a multi-stage adjustment process for administrative penalties. Initial calculations adjusted base amounts upward by 25 percent because the violation period exceeded one year but remained under two years. An additional 30 percent was added due to two or more similar regulatory violations occurring within the preceding three years. Conversely, investigators applied a 30 percent reduction reflecting the lack of direct commercial profit derived from the infractions.

Secondary adjustments factored in investigative obstruction, adding 10 percent for log deletions, which fell from the secretariat’s initial proposed 20 percent penalty. Committee deliberations raised mitigating factors from 40 percent to 50 percent to account for completed corrective actions, customer compensation, and broader privacy enhancements. Representatives for Coupang expressed regret that their proactive measures and factual explanations were omitted from the final determinations. The company confirmed plans to pursue administrative litigation to clarify the underlying facts through formal legal channels.

Market analysts monitoring the fallout observe that corporate capitalization frequently overshadows actual data sensitivity in determining administrative severity.