Taiwan fines Coupang 65 million won over data breach—one-thirty-fifth of South Korea's

[Financial News] Taiwan's government has imposed a total administrative fine of 1.5 million Taiwan dollars, or approximately 65 million won, on Coupang's Taiwan subsidiary and its representative over a personal information breach. A simple comparison of the fine per affected individual puts Taiwan's penalty at roughly one-thirty-fifth of South Korea's, prompting analysis that differences in the two countries' fine-calculation systems influenced the severity of the sanctions.
According to industry sources on the 21st, Taiwan's Ministry of Digital Affairs (MODA) imposed a fine of 750,000 Taiwan dollars each on Coupang's Taiwan subsidiary and its representative, for a total of 1.5 million Taiwan dollars, and issued a corrective order in connection with the personal information breach.
The Ministry of Digital Affairs determined that Coupang's Taiwan subsidiary had violated Taiwan's Personal Information Protection Act, which requires appropriate security measures to prevent the loss or leakage of personal information. Taiwan's Personal Information Protection Act stipulates that when a fine is imposed on a non-governmental entity, the same amount may also be imposed on its representative or person in charge. Accordingly, Coupang's Taiwan subsidiary's representative was also fined 750,000 Taiwan dollars.
However, Taiwanese authorities applied Article 48, Paragraph 2 of the Personal Information Protection Act to this case. They did not apply Paragraph 3, which covers serious violations and allows fines of up to roughly 600 million won. The authorities reportedly took into account the fact that no secondary financial damage had been confirmed and that Coupang had taken steps to compensate consumers and prevent a recurrence.
Some observers have consequently analyzed Taiwan's sanctions as relatively lenient compared with South Korea's. In June, South Korea's Personal Information Protection Commission (PIPC) imposed a total fine of 624.7 billion won on Coupang in connection with the leakage of personal information belonging to 37.55 million people and the unauthorized collection of information. Excluding the portion related to unauthorized collection, the fine for the personal information breach was 423.575 billion won. Divided by the number of affected individuals, that amounts to approximately 11,280 won per person.
By contrast, Taiwan imposed a total fine of 1.5 million Taiwan dollars, or approximately 65 million won, on Coupang's Taiwan subsidiary and its representative over the leakage of personal information belonging to 204,552 users. The fine amounted to approximately 7.33 Taiwan dollars, or about 318 won, per affected individual. In a simple comparison, South Korea's fine per person was roughly 35 times higher than Taiwan's.
The difference in the two countries' fine-calculation systems also contributed to the disparity in fines relative to the number of affected individuals. South Korea calculates fines based on factors including a company's average revenue over the preceding three years, while Taiwan sets separate fine ceilings for ordinary and serious violations. The PIPC classified this incident as a 'serious violation' based in part on the fact that personal information belonging to more than 37 million people had been leaked from Coupang.
An industry source said, "Ultimately, the differing policies of the Taiwanese and South Korean governments regarding data breaches led to a striking gap in the levels of fines imposed for the same incident."

[email protected] Jang Yu-ha Reporter