Punitive Damages Under Korea’s Personal Information Protection Act: The Coupang Data Breach Incident

The recent Coupang personal information leak incident has renewed discussion in Korea on the scope and effectiveness of punitive damages under Korea’s Personal Information Protection Act (PIPA) and also the extension of punitive damages beyond this act. Although the statute permits limited, capped punitive damages in certain circumstances, Korean courts have been conservative in applying these provisions, and several structural issues continue to limit their practical effect. Lawyers in Korea are increasingly criticizing the legal system for providing inadequate damages to the injured. We shall update the reader when more is known.

Korean Statutory Framework for Punitive Damages in Personal Information Protection Cases

Article 39(3) of the PIPA authorizes Korean courts to award up to five times the amount of actual damages when a personal information processor violates Korean statutory obligations. The provision was first introduced in 2016 at a three-times cap and was expanded to five times in 2023. This statute also shifts the burden of proving lack of intent or negligence to the personal information processor.

Despite these amendments, punitive damages in Korea have seldom been awarded. The large-scale Interpark breach in 2016 is a frequently cited example. Because the incident occurred shortly before the punitive-damages provision took effect, the courts in Korea declined, of course, to apply the amended law.

The Coupang matter is likely to become one of the first major tests of the expanded punitive-damages framework. However, it remains uncertain how Koran courts will interpret and apply the provision. We shall update the reader when more is known.

Can you multiply “Mental” Harm under the PIPA?

A significant issue concerns whether punitive damages may be applied to non-pecuniary harm (such as pain, suffering, emotional distress, loss of enjoyment of life). In the Incheon District Court, 2021Na74344 case, the court held that Article 39(3) should be understood as applying only to damages that can be proven through objective, quantifiable evidence. The Incheon Court reasoned that because emotional distress lacks quantifiable standards, punitive damages should be limited.

In practice, where plaintiffs allege only mental distress, courts frequently rely instead on Article 39-2 (Statutory Damages), which authorizes courts to set damages at up to KRW 3 million when the amount of loss is difficult to prove. In such cases, punitive damages are generally not awarded.

Damages in Pending Coupang litigation

Multiple lawsuits have been initiated in connection with the Coupang data breach incident. Current estimates suggest that claims per individual may fall within the KRW 100,000–500,000 range. Counsel for certain plaintiffs have indicated that they are collecting evidence of unauthorized deliveries, compromised access codes, and other specific losses, and may also pursue separate claims for emotional harm. Nevertheless, given the judicial approach described above, the applicability of punitive damages remains uncertain.

Gap in Korean Law: No Notification Duty for Unauthorized Sale or Misuse

The PIPA requires notification when a data leak or breach occurs (Article 34), but it does not impose a similar duty when personal information is sold, transferred, or used beyond the scope of consent. This distinction significantly limits individuals’ ability to identify and pursue claims arising from unauthorized use. We suspect this issue shall be addressed in the Korean National Assembly in the upcoming session.

The Homeplus Case (Supreme Court, 2018Da262103, May 2024) illustrates the issue. Between 2011 and 2014, Homeplus provided personal information of approximately 7.12 million individuals to insurance companies. Although half of the affected individuals had not consented, the Korean Supreme Court awarded KRW 50,000–300,000 per plaintiff in the litigation filed by a small subset of users.

The Korean Supreme Court reaffirmed that while the defendant bears the burden of demonstrating a lack of intent or negligence, the plaintiff must still establish actual damages. Because victims had no statutory notification rights in these circumstances, most individuals could not have known of the misuse absent investigative authorities’ involvement.

Structural Limits: Absence of Class Action Mechanisms

Korea does not provide for a class action procedure in personal-information cases and other mass torts. As a result, large-scale privacy breaches and other mass torts generate multiple repetitive claims and increase litigation costs while limiting effective redress for individuals whose losses may be modest. The large companies and business organizations have fought the extension of the class action law beyond security claims fiercely.

Conclusion

The Coupang data breach incident may provide the first meaningful opportunity for Korean courts to address punitive damages under the amended PIPA. However, several constraints remain:

• the limited judicial view of compensable harm under Article 39(3),
• the difficulty of proving loss in many cases,
• the absence of notification obligations for unauthorized secondary use of data, and
• the lack of a functional class-action mechanism.

We shall update the reader when more is known.

Sean Hayes is one of the most experienced foreign attorneys working in Korea and the first foreign attorney to work for the Korean court system. Sea is rated as one of the Top 100 attorneys working in Korea and IPG Legal is rated a top litigation law firm for Korea.

IPG Legal is a leading international boutique law firm based in Seoul, known for providing sophisticated, practical, and business-focused legal solutions for foreign companies and individuals operating in Korea. The firm combines senior Korean and foreign-trained attorneys with deep experience in corporate law, litigation, arbitration, FDI, employment, and regulatory compliance. IPG Legal is frequently retained in high-stakes corporate governance disputes, investigations, and complex commercial matters, and is trusted by Fortune 500 companies, global brands, and fast-growing enterprises for its hands-on advocacy and ability to deliver results in Korea’s challenging legal environment.

Sean’s profile may be found at Sean C. Hayes. To schedule a call with Sean Hayes, please click: Schedule a Call with Sean Hayes. Media inquiries welcomed.