The Korean government is pursuing class action lawsuits and punitive fines against companies responsible for major data breaches as incidents continue to grow in scale, including the recent Coupang case. If implemented, penalties could reach trillions of won in fines and damages.
President Lee Jae-myung has personally encouraged stronger sanctions, alongside the government and National Assembly, signaling that regulatory reforms for personal data protection will accelerate next year.
President Lee: "Companies act like 'so what?' after breaches—they need to fear bankruptcy"
The Personal Information Protection Commission (PIPC) reported to President Lee on Thursday that it will pursue fines of up to 10% of revenue for companies involved in large-scale data breaches or repeated violations, according to the government. The current ceiling stands at 3% of revenue, meaning the proposed change would more than triple the maximum penalty.
PIPC Chairwoman Song Kyung-hee told the president, "We will enhance the effectiveness of sanctions so that companies recognize investing in prevention is more advantageous than dealing with breach incidents."
President Lee immediately endorsed the initiative at the briefing. "Economic sanctions against companies that cause data breaches are too weak," Lee said. "Companies must make efforts to avoid violations and bear the costs. We need to give them the perception that harming citizens will result in severe economic sanctions—that their company could go bankrupt."
The punitive fine system is expected to gain momentum. Legislation has already been introduced in the National Assembly. On Monday, Rep. Park Beom-kye of the Democratic Party of Korea and others proposed an amendment to the Personal Information Protection Act allowing fines of up to 10% of revenue.
The bill limits punitive fines to cases where: violations were repeated due to willful misconduct or gross negligence within the past three years; willful misconduct or gross negligence caused harm to large-scale data subjects (10 million or more); or data was leaked due to non-compliance with corrective orders.
Chairwoman Song said the commission shares the same position as the parliamentary bill and is pursuing it jointly. "Public consensus on the necessity is forming, so we expect rapid progress, and the commission is making maximum efforts," Song said.
President Lee calls for class action system
During the briefing, President Lee also said class action lawsuits are necessary. "When the entire nation is victimized, telling each person to file individual lawsuits would cost more in legal fees than the damages," Lee said, urging legislators to "speed up the legislation."
The class action system Lee referenced allows all consumers to receive compensation if representative plaintiffs win a lawsuit, even those who did not participate. Currently, Korea only permits class actions in securities cases. The PIPC stated at the briefing that it would actively participate in discussions on introducing class actions.
President Lee personally called for stronger measures than the enhanced group litigation compensation plan the PIPC had proposed.
Class actions could expose Coupang to over 3 trillion won in damages
If such systems are implemented, corporate exposure from data breach incidents would increase dramatically. The largest fine imposed for violating the Personal Information Protection Act to date was against SK Telecom, which was fined 134.79 billion won for leaking personal data of 23.24 million people. The penalty was calculated by excluding unrelated revenue and applying the 3% ceiling with mitigating factors.
Applying the current standard to Coupang (CPNG), the theoretical maximum fine would be approximately 1.23 trillion won—3% of its 41 trillion won annual revenue.
If the ceiling is raised to 10% of revenue, Coupang's maximum potential fine would surge to 4.1 trillion won. The proposed amendment still allows exclusion of unrelated revenue and maintains the existing 3% standard for small and medium enterprises. However, cases involving willful misconduct or gross negligence affecting 10 million or more data subjects would qualify for punitive fines.
The government believes that because Coupang's incident occurred before any law revision, punitive fines would be difficult to apply even if introduced immediately. Chairwoman Song said punitive fines would be hard to apply retroactively but noted that group litigation "has applicable aspects that need to be examined specifically." Whether the class action system President Lee called for could also apply remains to be seen.
If class actions were applied to the Coupang case, damages could exceed 3 trillion won. Under the opt-out structure of class actions, where non-participating victims automatically qualify for compensation if plaintiffs win, companies must compensate all affected parties. Recent dispute mediations for data breach cases have proposed settlements of 100,000 to 300,000 won per person. The confirmed number of Coupang breach victims is 33.7 million. At 100,000 won per person, Coupang would face 3.37 trillion won in damages.
Consequently, if the law is revised, companies with annual revenue exceeding 10 trillion won that cause data breaches affecting more than 10 million people could face losses exceeding 1 trillion won each from fines and class action damages.
Chairwoman Song said the commission would clearly establish incentives for reducing fines when companies actively invest in prevention measures. "Institutions and companies that process large amounts of personal data face greater public harm and impact when breaches occur, so we will apply stricter standards, while actively reflecting routine investments as mitigating factors for fines," Song said.
