Cybersecurity Policy Report, Online Retailer Faces Fine in South Korea After Privacy Lapses, (Jun 15, 2026)

By Tony Foley

The South Korean Personal Information Protection Commission (PIPC) has sanctioned U.S.-based online retailer Coupang and an affiliate after finding that the companies violated provisions of South Korea’s Personal Information Protection Act (PIPA) regarding inadequate security measures and the collection of personal information without legal grounds.

Coupang was subject to an incident in which the personal information of approximately 37.5 million people was leaked due to inadequate basic security management systems, including negligence in authentication signature key management and access control, the PIPC said in a press release.

The agency also found that the company failed to fulfill its obligations regarding data breach notification and data destruction, did not ensure the independence of its chief privacy officer (CPO), and obstructed the PIPC’s investigation.

Finally, the PIPC concluded that Coupang illegally collected the online activity records of more than 11 million members who accessed third-party websites and apps, including user visit history regarding third-party sites where Coupang ads were displayed, and that the company’s failure to properly manage and supervise advertising partners displaying fraudulent ads resulted in the collection of usage records against users’ will.

As a result of its investigation, the PIPC fined Coupang 625 billion won ($413 million) and imposed an additional penalty of 16.8 million won ($11,100). In addition, the agency issued corrective orders requiring Coupang to strengthen its safety measures to prevent the occurrence of similar incidents, to guarantee the substantive role of the CPO, and to implement the agency’s recommendations on improving the personal information processing systems of withdrawn members within three months. Additional corrective orders require Coupang to enhance transparency in personal information processing, guarantee data subjects’ rights to choose regarding personalized ads, and strengthen management and supervision to prevent fraudulent advertising.

With respect to the company’s affiliate, Coupang Fulfillment Service (CFS), the PIPC found that it collected a list of 71 National Police Agency press corps members with no history of working at logistics centers and registered and managed their names on an employee restriction list in violation of the PIPA. CFS also submitted employees’ weight information, which it had held and managed for purposes of an employee health management program, to a court during litigation concerning an industrial accident, which the PIPC concluded violated provisions related to the processing of sensitive personal information. Accordingly, CFS was fined 248 million won ($164,000).

The decision may be downloaded from the press release but is available only in Korean.

News: InternationalLegislation LitigationEnforcement DataPrivacy DataSecurity DataBreach