President Lee addresses Coupang fine controversy, stating penalties are lawful, not targeted

President Lee Jae-myung has pushed back against claims that recent hefty fines for personal information breaches are unfairly targeting specific companies. Speaking at a public reporting session, Lee stated that such penalties are applied strictly according to established laws and policies, not as a form of selective enforcement.

His remarks were widely interpreted as a response to Coupang, which was recently fined 624.6 billion won by the Personal Information Protection Commission for a massive data leak. Lee suggested that some companies might be misinterpreting the situation, asserting that the government's actions are impartial and based on legal frameworks.

“

It would be good to fully explain that this was done according to the law and policy, without considering the company's characteristics at all.

Lee highlighted a pattern where companies often show insufficient interest in data protection until a significant breach occurs. He noted that the cost of data breaches and subsequent fines can sometimes appear less than the investment required for robust security measures, leading to a de facto neglect of data protection. The president also acknowledged the possibility of numerous unreported data leaks, underscoring the need for stricter enforcement.

To incentivize better data security practices, Lee proposed significantly increasing penalties for personal information leaks and misuse. The goal is to ensure that the cost of non-compliance far exceeds the expenses associated with implementing comprehensive data protection measures. This approach aims to compel companies to prioritize data security proactively. The U.S. government has previously expressed concerns to South Korea regarding regulations and enforcement actions perceived as targeting or discriminating against American tech companies, including Coupang.

“

We must significantly increase the fines for personal information leaks and misuse according to our policy, making them far exceed the costs of personal information protection, so that companies will actually engage in personal information protection activities.