[Editorial] The elusive founder

The Science, ICT, Broadcasting and Communications Committee of the National Assembly will hold a hearing on Coupang’s massive leak of customers' personal data next Wednesday.

Several individuals were named as key witnesses. They include Chair Kim Bom-suk, the Coupang founder and de facto owner also known as Bom Kim; former Coupang Corp. CEO Park Dae-jun; and Kang Han-seung, head of the e-commerce giant’s North American operations.

However, it is unclear whether Kim will attend.

Whenever legislators have summoned him to the Assembly, he has not appeared, citing his presence abroad. This time will likely be no different.

During the National Assembly inquiry into pending issues last Wednesday, Park drew the line on the matter of Kim's attendance, saying the company’s business in Korea is “my responsibility.” Park resigned as Coupang Corp. CEO on Wednesday.

He also said he did not know where Kim was in the US. Few would accept this. It is a mockery of those 33.7 million Coupang members whose personal data was breached.

Despite most of Coupang's sales coming from the Korean market and his substantial decision-making authority, Kim has remained silent about the incident and out of sight.

Coupang Corp. is wholly owned by Coupang Inc., the US-based parent company of the South Korean subsidiary. Kim controls more than 73 percent of voting rights in Coupang Inc.

Kim was born in Seoul, went to the US with his father as a child, obtained US citizenship, and started Coupang in 2010. After a fire in June 2021 at a Coupang logistics center in Gyeonggi Province, Kim resigned as board chair and as a registered director of the Korean corporation. At that time, critics suspected him of trying to avoid punishment before the Serious Accidents Punishment Act came into effect. Apparently, his resignation enabled him to escape legal responsibility.

Should he not be ashamed of shifting the blame for the massive data leak onto a salaried CEO, while calling the shots as top manager?

Such a governance structure is likely to result in unchanged or poor investment decisions regarding safety and data security.

In a structure that grants him significant voting rights, definitive accountability should be demanded from the substantive ruler as well.

The data leak was not just a technical error but a serious incident that highlighted problems with the governance structure and accountability. When personal information of so many people is leaked, it is the business owner’s minimum obligation to apologize and explain directly.

He must attend the hearing, which serves the crucial function of confirming facts and finding ways to prevent future issues.

Coupang faces a wave of joint lawsuits demanding damages for the data breach.

So far, about 200,000 people have reportedly filed lawsuits through law firms. That figure is not insignificant, but it is still small in comparison to the total number of people who had their data leaked.

Based on precedent, even if they win the case, each victim might receive as little as 100,000 won ($68) in compensation. This is far from substantial relief.

Since the potential compensation is so low, damage lawsuits are limited in their ability to compel companies to take the consequences of data leaks seriously.

In the US, these situations typically result in class-action suits.

This system has been introduced in Korea on a limited basis in the securities field — but it is seldom used because of the complicated procedures and narrow scope. It is difficult for individuals to secure the evidence they need because they are locked out of the company data systems.

A New York-based office of Korean law firm Daeryun is said to be preparing a class-action lawsuit seeking punitive damages. While it is difficult for victims to secure internal company data in Korea, in the US, they would be able to access some of Coupang’s internal data through the discovery process.

Though the data leak occurred in Korea, victims, ironically, mainly anticipate securing Coupang data via a US class-action lawsuit.

Following the Coupang data breach, Korea should make its class-action legal framework more substantial and effective.