₩248 million. A separate fine, against a separate entity — and a fundamentally different set of violations.
While South Korea’s record $409M penalty against Coupang focused on a breach affecting 37.5 million consumers, the PIPC’s action against Coupang Fulfillment Services targets something regulators rarely reach: internal HR data governance.
The subsidiary compiled a blacklist of 71 police-beat journalists — none of whom had ever worked at a Coupang warehouse — placing them on an employment restriction list under the pretext of ‘spreading false information.’ No consent. No notice. No legal basis.
It went further. The subsidiary submitted employees’ weight data, originally collected for health management purposes, as evidence in an industrial accident lawsuit — without establishing a separate legal basis for the new processing purpose.
Coupang has announced it will appeal all fines in Seoul Administrative Court.
What this means for your compliance team:
→ Privacy enforcement is expanding from customer data into HR and internal profiling practices. The same rules apply to employee data — and regulators are now looking.
→ Purpose limitation applies to internal data too. Health data collected for one purpose cannot be repurposed for litigation without a separate legal basis.
→ Blacklisting based on professional affiliation is a personal data processing activity. If your organisation maintains any form of employment restriction list, it must have a lawful basis.
→ Subsidiary liability is real. CFS received its own fine, independent of the parent company’s $409M penalty.
At S8fe.ai, we help organisations map personal data across all operations — including HR, internal profiling, and employee health data — so compliance gaps don’t surface first in an enforcement action.
Employee data is personal data. The rules don’t change because the data subject is on your payroll.
Sources:
• https://www.anews.com.tr/asia/2026/06/11/south-korea-fines-coupang-record-410m-over-privacy-violations/amp
• https://www.business-humanrights.org/en/latest-news/s-korea-coupang-hit-with-623-billion-won-fine-over-data-breach-and-misuse-of-employee-data/