Gov’t mulls suspension for Coupang over data leak, but experts question practicality

The government is weighing a possible business suspension for Coupang following a massive personal data leak and the company’s failure to respond swiftly to the issue, but such a move may be unrealistic, experts caution.

In a Science, ICT, Broadcasting and Communications Committee at the National Assembly in Yeouido, western Seoul, on December 17, Minister of Science and ICT Bae Kyung-hoon said that his ministry is in communication with the Fair Trade Commission (FTC), which has the authority to enact a suspension.

“We will be actively discussing the matter with the Fair Trade Commission and will open an immediate investigation,” he said. “The Fair Trade Commission will also be making a decision based on the investigation results.”

Under the Act on Consumer Protection in Electronic Commerce, the FTC can temporarily suspend all or some of the e-commerce conducted by the company.

The FTC also said that it would “comprehensively consider whether Coupang meets the prerequisites for a business suspension” after the investigation results are released.

“A temporary suspension of business is possible if the 32nd clause of the Consumer Protection is applied,” Prof. Choi Kyoung-jin of Gachon University’s College of Law said. Choi also chairs the Korea Association of Personal Data Professionals.

Coupang reported in November that the personal information of more than 33.7 million users, including their names, addresses, phone numbers and recent purchase history, was compromised. It was later revealed that a former Coupang employee had accessed the company’s main server after he left the company.

The 32nd clause of the Act on the Consumer Protection in Electronic Commerce states that the FTC “may order [a company] to fully or partially suspend the business for a fixed period of up to one year,” but only if the violations are repeated despite the corrective measures, if the corrective measures are not followed or when the corrective measures are deemed unlikely to prevent damage or it is impossible to compensate consumers properly.

However, the application of the law in this case is disputed, particularly as it applies to a hacking incident or a lapse in personal data protection under the violations enumerated in Article 21.
 
If Coupang were to be slapped with a suspension for just a day, it would be barred from selling products and offering services to customers. But it also means its delivery drivers, fulfillment centers and the more than 92,000 workers directly employed by Coupang would also be affected.

Prof. Choi, however, suggested that it might be unlikely for Coupang to end up in that position.

“The disadvantage to consumers if Coupang’s business is suspended should also be considered,” the professor noted, and in that context, “It doesn’t look easy for Coupang to get a business suspension.”

The FTC may adhere to precedent. In 2024, it decided to fine game publisher Nexon 11.5 billion won ($7.78 million) for rigging its loot box drop rates instead of imposing a suspension for six months, considering the inconvenience for end users. The 11.5 billion won was an estimation of Nexon’s revenue in the preceding six months.

BY CHO YONG-JUN [cho.yongjun1@joongang.co.kr]