The Personal Information Protection Commission under the prime minister demanded that Coupang immediately take down the notice of its own investigation posted on its website and application (app), but as of 12:30 p.m. on the 16th, no further follow-up action has been taken. Coupang is expected to receive the Personal Information Protection Commission's resolution, review the details, and then take measures.
As compensation for the personal information leak, Coupang has been providing purchase vouchers (compensation coupons) since the previous day. The main screens of the website and app carry a notice that reads, "We are giving you a purchase voucher," and clicking it takes users to the "Notice on personal information leak incident" page along with the guidance. That page contains, as is, the self-investigation notice content that Coupang previously disclosed.
On the 14th, the Personal Information Protection Commission held a general meeting and told Coupang to immediately stop posting the self-investigation notice. The Personal Information Protection Commission said, "Coupang is posting on the app and web as if they were facts confirmed in an official investigation the one-sided statements obtained through direct contact with a former employee identified as the leaker," adding, "This could mislead the public about the situation, make it difficult to determine the exact leaked content and scope of damage, and potentially hinder the commission's investigative activities."
Coupang announced the results of its own investigation on the 25th, Christmas Day, last month. It said the leaker accessed information on 33 million customers but saved only about 3,000 accounts and has since deleted them all.
However, the police, who are currently investigating the case, believe the actual scope of the leak could be larger and are conducting additional analysis, and plan to identify the scale of damage once the analysis is complete.
The Personal Information Protection Commission also determined that Coupang's implementation of previous improvement recommendations was largely perfunctory and insufficient. Accordingly, it asked Coupang to provide a lookup function in the app and on the web to check whether personal information was leaked, and to promptly notify people who were included on shipping address lists but are not Coupang members of the leak.
The Personal Information Protection Commission plans to send Coupang a resolution containing the requests from the general meeting during the day. Coupang is also expected to take follow-up measures after receiving the resolution.
Under the Personal Information Protection Act, the Personal Information Protection Commission may, after deliberation and resolution, present opinions for personal information protection to relevant agencies or recommend improvements to personal information handlers such as corporations. After reflecting the recommendations, personal information handlers must report follow-up measures to the Personal Information Protection Commission.
This year, the Personal Information Protection Commission decided to toughen sanctions for violations by raising the criteria for imposing a penalty surcharge and pushing to introduce punitive penalty surcharges of up to 10% of annual sales.