A Regulator Tests Its Old Ceiling Just Before a Higher One Arrives
By mid-May 2026, South Korea's Personal Information Protection Commission (PIPC) had completed its probe of the November 2025 Coupang breach and issued a pre-notice of disposition outlining alleged violations of the Personal Information Protection Act (PIPA). Korean outlets reported on May 12 that the commission was preparing to refer the case to a plenary session, with a final sanctions ruling possible as early as June. Coupang has already filed objections; the Korea Times reported the company conveyed "difficulty agreeing with the PIPC's planned disposition."
The numbers in play are unprecedented. With Coupang Inc.'s 2024 revenue near KRW 49 trillion, the statutory ceiling under the current PIPA — 3% of the three-year average — pencils out to roughly KRW 1.5 trillion (about USD 1.07 billion). That would dwarf the KRW 134.8 billion (~USD 97 million) levy imposed on SK Telecom on August 28, 2025, which until now stood as the country's largest privacy fine.
Now read the calendar carefully. The National Assembly passed an amendment to PIPA on February 12, 2026; it was promulgated on March 10 and takes effect on September 11, 2026. The amendment leaves the baseline 3% intact, but adds a new Article 64-2 aggravated tier of up to 10% of total turnover when a company (a) intentionally or with gross negligence repeats a violation within three years, (b) acts with intent or gross negligence in a way that affects 10 million or more individuals, or (c) fails to comply with a PIPC corrective order. Coupang's case will almost certainly settle under the old ceiling. The next one will not.
The Case for the Big Stick
Start with the strongest version of PIPC's posture. The SK Telecom ruling documented elementary security failures — 26.1 million unencrypted USIM authentication keys sitting in plain-text databases, intrusion detection logs nobody read, an unpatched 2016 vulnerability, internal and external networks fused into one flat plane. When the country's largest carrier exposes data on roughly 45% of the population because it never bothered with access controls, the deterrence argument writes itself. A fine that does not sting will not shift boardroom priorities — and the September amendment's 10% ceiling is explicitly justified, the PIPC says, by exactly that principle.
The Coupang facts are also serious. The Korea Economic Institute's timeline records unauthorized access between April and November 2025 enabled by an internal signing key a departing engineer reportedly walked off with in late 2024. The breach hit roughly 33.7 million accounts — nearly two-thirds of South Korea's population. The Ministry of Science and ICT characterised it as "a management problem." Korean civil society pressure has been intense, and the case is the proximate political driver of the amendment now four months from taking effect.
Where Proportionality Starts to Strain
The case for restraint, though, is not weak.
Redress is already running. Coupang has committed roughly KRW 1.69 trillion (~USD 1.18 billion) to user compensation — 50,000-won vouchers for affected customers — which by itself exceeds the theoretical statutory fine. A KRW 1.5-trillion administrative penalty stacked on top of a KRW 1.69-trillion remediation programme is not the same calibration problem as fining a company that has paid affected users nothing. The vouchers have been fairly criticised as marketing-flavoured; the right policy answer is to police the form of the remedy, not to pretend the money is not moving.
The harm-to-exposure mapping is unusually contested in this case. Reuters and Korean outlets have reported that investigators found data for roughly 3,000 customers actually stored on the suspect's personal computer, even though the access vector implicated 33.7 million accounts. This is not a defence for sloppy key management — Coupang plainly failed to rotate or revoke a former employee's signing credentials for nearly a year — but it does matter for fine sizing. A penalty calibrated to records actually exfiltrated by a malicious insider is a different instrument than one calibrated to the headline number of records exposed to that insider's reach. Both can be enforced; they should not produce the same number.
The September thresholds are blunter than the rhetoric suggests. The 10-million-affected-individuals trigger sits below the user base of essentially every major Korean consumer platform — Naver, Kakao, the major carriers, the major banks. Any breach at any of them automatically clears that gate. The "gross negligence" qualifier matters, but it will be litigated against the most expansive reading regulators choose to apply. In practice, PIPC is writing itself a 10%-of-turnover hammer it can reach for in every significant incident, with the discretion to make the gross-negligence finding largely on its own.
Korea Is About to Run the World's Harshest Privacy Fine Ceiling
The September regime will put South Korea's headline ceiling above the EU's GDPR (4% of global turnover) and above the Digital Services Act's 6%. That is a deliberate choice. But ceilings cast shadows. Korean platforms operate in an environment where domestic incumbents already compete with Google, Amazon, and Chinese rivals. An enforcement matrix substantially harsher than what those foreign competitors face at home does not make Korean users safer; it makes Korean platforms less able to invest in product, in security R&D, and in international expansion.
A better calibration is achievable inside the existing statute. PIPC should tie aggravated penalties to demonstrated harm and remediation gaps, not to user-count thresholds that catch every platform by definition. The amendment's own reduction mechanism — fines may be reduced where a company can show verified investment in privacy budgets, personnel, and systems — points the right way. The commission should publish a transparent methodology for how those investments translate into reductions before the September trigger date, so security spending becomes a contract rather than a hope.
Coupang's case is not a referendum on whether Korean privacy enforcement should have teeth. SK Telecom settled that question last August. The question now is whether the next decade of enforcement will be calibrated to harm, culpability, and remediation — or to revenue, regardless. The pre-notice tells regulators which lever they are about to inherit. They should think hard about how often to pull it.