[비즈한국] 100,000 won. This is the compensation amount awarded to users in past damage lawsuits following data breach incidents.
When approximately 100 million pieces of personal data—including customer names, resident registration numbers, and card numbers—were leaked from KB Kookmin, NH NongHyup, and Lotte Card in 2014, victims demanded 200,000 to 700,000 won per person. However, the court ruled in favor of 100,000 won. The decision took into account that no additional property damage had been confirmed and that the credit card companies had made efforts to prevent secondary damages. Subsequently, in cases like the 2016 Interpark035080 and 2024 Modetour data breaches, the court maintained its stance of awarding 100,000 won per person to those who filed class-action damage suits.
However, the legal community suggests that the "Coupang data breach incident" should serve as an opportunity to revise this standard. They argue that companies must be held to higher levels of accountability regarding the recurring issue of personal data mismanagement and leaks. In Coupang's case, approximately 33.7 million pieces of customer information were leaked, the largest scale for a single company in history. With the government also mentioning the necessity for high-level fines, some speculate that the court's judgment may change.
Some rulings state “no liability” for companies that implemented protective measures
Korean law is often evaluated as being more favorable to corporations compared to countries like the United States. Under current law, victims can claim up to 3 million won in damages when a data breach occurs, and if gross negligence is proven, the compensation can be set up to five times the amount of actual damages.
In particular, even victims whose information was leaked must directly participate in a lawsuit to receive compensation, and after subtracting legal fees, almost nothing remains from a 100,000-won award. Furthermore, it usually takes two to three years for a final court ruling to be reached.
There have even been rulings stating that a company bears no responsibility if it fulfilled all "protective measures." In 2014, when 11.7 million pieces of personal data belonging to 9.81 million KT030200 subscribers were leaked, victims filed a lawsuit demanding "500,000 won per person," but the Supreme Court did not recognize KT's liability for damages. The second trial court judged that "KT cannot be held liable as the information breach occurred despite the company implementing protective measures required by law," and the Supreme Court confirmed this ruling.
Government hints at ‘largest ever fine’
Law firms are moving quickly in response to Coupang's record-breaking data breach. Law firms such as Chung, Jihyang, Beonhwa, and Lawfeed are recruiting participants for damage claims. Law Firm Chung, which was the first to participate in the damage lawsuit, submitted a complaint to the Seoul Central District Court on the 1st on behalf of 14 users, claiming 200,000 won in consolation money per person.
The legal community estimates that over 15,000 people intend to file damage lawsuits through various law firms. Most plan to demand 200,000 won in compensation. Since the court's existing precedent is stuck at 100,000 won, they are attempting to pursue class actions within reasonable limits, considering the costs involved in litigation.
If the court rules for 100,000 won in damages as is customary, the actual compensation victims might secure after legal fees is likely to be around 50,000 won.
Because of this, the legal community points out that "it is time to increase the compensation." A presiding judge at a high court, speaking on a "personal opinion" basis, noted, "Considering that the risks arising from data breaches have increased and given the social atmosphere that personal data must be handled more strictly, the figure of '100,000 won' seems stuck in the past. It seems necessary to place a higher value on the potential for various crimes that victims may be exposed to due to data leaks, and to hold companies accountable accordingly."
This is also why law firms are considering filing suits through U.S. courts. On the 5th, Law Firm Daeryoon filed a complaint against Coupang CEO Park Dae-joon and managers in charge of personal information certification for violating the Personal Information Protection Act and professional malpractice. They are also considering a class-action lawsuit against the Coupang headquarters in the U.S. in collaboration with the local New York firm SJKP LLP. This is because the U.S. has a punitive damages system that can lead to more substantial remedies for victims.
As the government has signaled a strong response, including the possibility of imposing the largest fine in history, there is talk that the court's "benchmark amount" could rise this time. A partner at a large law firm who is a former judge predicted, "Compared to the 3 million won legal guideline, 100,000 won is an excessively small amount. If the government imposes high fines, the court will likely raise the compensation amounts as well. The degree of Coupang's negligence revealed through police investigations will also influence the judgment on compensation amounts."