The Science, ICT, Broadcasting and Communications Committee on the 2nd pressed hard on the question of responsibility for Bom Kim, chair who founded Coupang, during an emergency inquiry into the unprecedented breach of personal information affecting 33.7 million people. Park Dae-jun, the Coupang CEO who appeared as a witness in place of the chair, said, "I will take responsibility at my level," but drew criticism as he failed to give clear answers on key facts and did not provide materials requested by lawmakers' offices, continuing a stance of "not knowing." In response, the Science, ICT, Broadcasting and Communications Committee is considering holding a hearing to summon the chair.
At the emergency inquiry on "Coupang's massive personal information leak" held by the Science, ICT, Broadcasting and Communications Committee that day, CEO Park and Brett Mathis, Coupang's chief information security officer (CISO), appeared. Park said, "This incident occurred at the Korea subsidiary," and repeatedly noted, "As the final decision-maker for the Korea business, I will take responsibility to the end and resolve the situation."
Lawmakers on the Science, ICT, Broadcasting and Communications Committee from both the ruling and opposition parties poured out questions about the whereabouts of the chair, who has not appeared despite the worst information leak, and demanded the chair's apology. They said that, as the real owner and founder of Coupang, the chair should not evade responsibility. Chairperson Choi Min-hee of the Democratic Party of Korea and People Power Party lawmakers Park Jeong-hun and Lee Sang-hwi repeatedly asked, "Where on earth is the chair?" but Park remained consistent, saying, "The chair is in charge of global business," "I reported to the chair," while also saying, "I do not know exactly where the chair is."
In particular, lawmakers criticized Coupang's stance on submitting materials. Democratic Party lawmaker Kim Hyeon said, "Coupang has 40 to 50 government relations personnel," adding, "They were quick to block the chair or president from appearing as witnesses, but then cut off contact when asked to submit materials." Chairperson Choi also said, "Lawmakers requested materials. (From Coupang's side) they did not even provide information on their own security system management rules, and even though it is not a trade secret, they are trying not to give (the requested materials)," adding, "The police investigation is only to determine whether a crime was committed. If you keep using the police as an excuse not to answer like this, we will push for a hearing to call the chair as a witness, with agreement between the ruling and opposition party secretaries."
In the process, Coupang acknowledged that some shared entrance passwords for customers' buildings were also leaked. Earlier, Coupang had notified that customers' names, email addresses, address books for delivery destinations, and some order information had been exposed. But it turned out that shared entrance passwords were also included. Contrary to CEO Park's remark that there was "no secondary damage," it also emerged that Coupang accounts were being sold for 40,000 won on Chinese e-commerce sites such as Taobao Mall.
Lawmakers from both parties also urged strong sanctions against Coupang, including imposing a penalty surcharge of more than 1 trillion won. Some said that, if necessary, a suspension of business should be considered. The current Personal Information Protection Act allows for a penalty surcharge of up to 3% of the previous year's sales for violations of the law. Given that Coupang's sales last year were about 42 trillion won, the penalty surcharge is estimated to reach 1.2 trillion won.
Lee Jeong-ryeol, vice chairperson of the Personal Information Protection Commission, said about the possibility of imposing a penalty surcharge in the 1 trillion won range, "Because this corresponds to a leak, it is judged to be subject to a penalty surcharge. (A surcharge in the 1 trillion won range) is under focused review," adding, "The commission will make a comprehensive decision, considering not only the confirmation of the sales amount but also the seriousness of the violation."