Chairperson Choi Min-hee of the Science, ICT, Broadcasting and Communications Committee publicly raised the possibility of holding a hearing during an emergency inquiry on Dec. 2 into Coupang's massive personal data leak. It was a warning after Coupang CEO Park Dae-jun and Coupang Chief Information Security Officer Brett Mathis offered only vague answers, citing "a police investigation."
Chairperson Choi, during the inquiry held at the main building of the National Assembly that day, said to CEO Park, "CEO Park is evading answers by using the police as an excuse. Before this meeting ends, we will set a hearing date by agreement between the ruling and opposition secretaries," adding, "We will also designate as witnesses CEO Park as well as Chair Bom Kim, Coupang's de facto owner."
Chairperson Choi also criticized Coupang's attitude toward submitting materials. Choi said, "We requested materials for lawmakers, but Coupang did not even provide information on its own security system management rules," and added, "They are trying not to hand them over even though it is not a trade secret." Choi went on, "A police investigation is to determine whether a crime occurred," adding, "If you keep using the police as an excuse and do not answer, we will soon hold a hearing."
During this process, questions also arose about the position of Coupang Chair Bom Kim. CEO Park said the Korean corporation is operated under his responsibility, but lawmakers argued that Chair Kim, regarded as the person with actual authority, must also appear before the National Assembly to take responsibility for the massive personal data leak. Park said, "Chair Kim is in charge of 'global business,'" adding, "I do not know his location." Lawmakers from the Science, ICT, Broadcasting and Communications Committee of both the ruling and opposition parties pointed out, "The situation is this serious, and you are saying you don't know the whereabouts of the actual owner?"
CEO Park repeatedly apologized, saying he "fully acknowledges responsibility." When pressed on how the apology was posted, Park explained, "We put it up as a banner-style pop-up notice," adding, "We are preparing to send more detailed information and an apology email." The apology banner has now been taken down from the website.
Lee Jeong-ryeol, vice chairperson of the Personal Information Protection Commission, said, "All provisions, including the reporting obligation under the Act on Promotion of Information and Communications Network Utilization and Information Protection, apply even to overseas corporations if they affect our people," adding, "We will investigate more strictly and take action."