Seoul defends Coupang privacy fine as US lawmakers question fairness

South Korea is defending a record 625 billion won, about $422 million, fine on US-owned eCommerce company Coupang, after American lawmakers questioned whether Seoul is treating US companies fairly, Reuters reported on July 20. The dispute has become a bilateral irritant, with South Korea’s ambassador to the United States returning to Seoul for talks with officials in President Lee Jae Myung’s administration, according to Reuters.

The penalty followed a November 2025 data leak at Coupang, a company often described as South Korea’s equivalent of Amazon. South Korean officials have said the sanction was tied to the breach, while US officials have raised concerns about the treatment of American businesses operating in the country.

Kang Kyung-wha, South Korea’s ambassador to the US, told local media that “the issue is dragging on much longer than I expected,” Reuters reported. Her return to Seoul underscores how a privacy enforcement case has moved into the broader trade and investment relationship between the two allies.

Park Sun-won, a lawmaker from South Korea’s ruling Democratic Party, told Reuters that the fine was imposed because of the data leak and that the penalty “would be the same for any company.” A US State Department spokesperson told Reuters that South Korea “should not impose disproportionate burdens on U.S. companies.”

Coupang told Reuters that it hoped to reach a constructive resolution.

Data breach triggered record privacy action

The case stems from a cybersecurity incident disclosed in November 2025. Reports at the time said the breach exposed personal information across Coupang’s customer base, including names, email addresses, phone numbers, shipping addresses and some order histories.

Coupang later said in December 2025 that the perpetrator, identified by the company as a former employee, had retained data from only 3,000 accounts, had not transferred the data to others and deleted it after media reports about the incident began.

On Dec. 29, Coupang issued an apology from its interim chief executive and said it would offer vouchers worth up to 55,000 won, or $38, to each of the 33.7 million customers affected by the cybersecurity incident.

South Korea’s Personal Information Protection Commission levied the fine in June. At the time, it was reported as roughly $412 million and described as the largest privacy-related penalty ever imposed in South Korea.

Privacy fines are typically set by regulators after assessing the alleged breach, the scale of affected data, the company’s controls and the legal duties imposed on firms that collect or process personal information. In this case, Seoul’s position, as described by Park to Reuters, is that the sanction reflects the conduct at issue rather than Coupang’s ownership.

Investors and lawmakers press Washington

The dispute has also drawn investor attention in the United States. In December 2025, an investor class action lawsuit filed in California alleged that Coupang violated securities laws by misleading investors about its data security practices and by failing to disclose the breach in a timely way.

In January, two Coupang investors called on the US government to examine South Korea’s handling of the incident. They said Washington could consider trade remedies in response to what they described as discriminatory treatment of Coupang.

The case places Seoul’s privacy enforcement regime under international scrutiny at a time when governments are imposing larger penalties for data lapses and foreign companies are more sensitive to regulatory risk. Reuters reported that South Korea maintains the fine is a data-protection matter, while US officials and lawmakers are pressing for assurance that enforcement is proportionate and non-discriminatory.

This story draws on original reporting from PYMNTS.