Coupang (CPNG) was hit with a record-high fine over a personal data breach, yet its share price surged. Despite a level of sanction that is unusual even by global standards, the market focused on the fact that much of the regulatory uncertainty had been resolved, which analysts interpret as the result of improved investor sentiment.
According to the New York Stock Exchange (NYSE), Coupang's shares closed regular trading at $17.25 on Thursday, up 14.09% from the previous session, immediately after the fine was announced. Coupang's stock had fallen about 45%, from around $27 last December to as low as $14.9 during intraday trading on Dec. 8.
The market views the stock's rebound despite the large-scale sanction as a sign that much of the regulatory risk surrounding Coupang has been resolved, and that the negative news, assuming the worst-case scenario, had already been priced in. Reuters reported last December that "Korean regulators could impose a fine of more than 1 trillion won (about $680 million) on Coupang," heightening market concerns.
The Personal Information Protection Commission (PIPC) decided on Dec. 11 to impose a fine of 624.681 billion won and a penalty of 16.8 million won on Coupang. It is the largest ever among cases of personal information protection law violations, both in Korea and abroad. However, a closer look at the details shows that the fine reflected a rate of about 1% of revenue, rather than the worst-case scenario assumed by the market. Under the current Personal Information Protection Act, fines can be imposed up to 3% of average revenue over the three fiscal years immediately preceding the violation. While there had initially been observations that the fine could reach about 1.36 trillion won, or 3% of Coupang's revenue, the PIPC calculated the amount without including revenue from Coupang Eats and Coupang Play, which are not directly related to the violation.
Yang Cheong-sam, secretary general of the PIPC, explained in a briefing at the time that "although the fine standard is set at 3% of revenue, we are considering all aggravating and mitigating factors," adding, "We worked to impose a commensurate disposition by comprehensively considering the gravity of the case and the scale of the damage."
Regarding this, Morgan Stanley assessed that "Coupang's final fine of about $400 million is in line with expectations and falls short of the level the market had feared," adding, "This decision will serve as an opportunity to resolve the significant uncertainty surrounding Coupang's stock." Last month, Morgan Stanley issued an "Overweight" opinion on Coupang with a target price of $28.
However, variables remain. Class-action lawsuits have been filed in both Korea and the United States. The law firms representing the lawsuits at the time claimed compensation of around 100,000 to 500,000 won per person, considering precedents. Considering the legal costs incurred during the litigation process and future claims, projections suggest that the amount Coupang will have to pay in connection with the data breach could grow even larger.
Meanwhile, Coupang filed an administrative lawsuit contesting the PIPC fine. On Dec. 11, Coupang said, "We regret that our preemptive measures to prevent secondary damage related to the data breach, and our explanations based on clear facts, were not sufficiently reflected in the PIPC's decision," adding, "We will clearly establish the facts through legal procedures after receiving the official resolution."
