Momentum is building not only in South Korea but also in U.S. courts, where a class action lawsuit is being pursued against Coupang following a major data breach.
Legal experts suggest that if the U.S. lawsuit sets a precedent, it could lead to increased compensation amounts in Korea lawsuits against Coupang. However, some speculate that jurisdictional issues may prevent the case from proceeding in U.S. courts.
According to reports from the retail and legal sectors on Wednesday, SJKP, a U.S. law firm affiliated with Daeryun, plans to file a punitive damages lawsuit in a U.S. court against Coupang Inc., the parent company of the South Korean Coupang entity.
This lawsuit seeks to determine the liability of Coupang Inc., which owns 100% of the South Korean subsidiary, regarding the security systems and remedial actions taken during the data breach incident.
Notably, unlike South Korea, the U.S. legal system allows for punitive damages. For instance, in 2017, the American credit reporting agency Equifax settled for $700 million after a data breach affecting 30 million customers. If Coupang is found liable, it could face damages in the billions of dollars.
The recognition of class-action lawsuits also sets the U.S. apart from South Korea. If some victims win their case against the company, other affected customers can later claim compensation. This could lead to an expansion of the lawsuit against Coupang.
However, skepticism persists within the legal community. To proceed with a lawsuit in a U.S. court, the court must have jurisdiction over the case, which may not apply to an incident that occurred in South Korea, with most victims being South Korean.
Additionally, the applicability of U.S. law to this case is under scrutiny. Even if the lawsuit moves forward, disputes over the plaintiffs’ standing could prolong the proceedings. So far, outside of the data breach, no specific consumer harm, such as payment fraud, has been officially confirmed.
Some experts argue that even if Coupang Inc. is found at fault, historical U.S. lawsuit outcomes suggest that the compensation amounts may not be substantial. For example, during the Facebook data breach in 2019, the settlement reached $725 million, but with 17 million participants, the individual payout was only around $37.50.
A lawyer in Seoul’s Seocho district commented that the central issue in the U.S. case may be whether it is appropriate to handle it in the United States at all. The lawyer said the case could be dismissed if standing is not established.
Nonetheless, if the lawsuit proceeds smoothly in the U.S., it could strengthen public opinion regarding Coupang’s accountability. Additionally, evidence gathered during the U.S. court process could be used in the South Korean lawsuit. Recently, hundreds of U.S. nationals, including military personnel and their families, have initiated a class-action lawsuit against Coupang, which could also influence the situation.
This could potentially broaden Coupang’s liability in domestic lawsuits. Especially this year, large-scale data breaches have occurred repeatedly, and the South Korean Personal Information Protection Commission has been treating data breaches seriously, leading to expectations that the compensation amounts recognized in domestic class-action lawsuits may exceed the usual levels of around $75 USD.
Last month, the Personal Information Dispute Mediation Committee recommended a compensation of $225 per applicant in the SK Telecom SIM card information breach case. In 2022, a court set the compensation amount for a data breach involving the accommodation reservation service Yeogi at about $300.
In particular, President Lee Jae Myung’s direct call to implement punitive damages in relation to the Coupang incident adds another variable. Presidential spokesperson Kang Yu Jeong reported on Tuesday that President Lee emphasized the need to actualize penalties during a cabinet meeting regarding the Coupang situation.
Jeong Da Som, a researcher at Korea Investment & Securities, said the decisive factor will be whether the court finds the company’s intent or gross negligence. Jeong added that if secondary harm beyond the data breach itself is confirmed, individual compensation could exceed $750.
