[Q&A] “Coupang Korean victims can file a U.S. lawsuit in parallel without any additional costs.”

“Disclosure of internal data following the US court’s ‘evidence discovery’ procedure is a ‘smoking gun’”
“Important litigation issues such as lack of internal control system and follow-up response process”

A class action lawsuit is being filed against Coupang's U.S. headquarters, which caused the leak of 33.7 million personal information. Daeryun Law Firm, which is leading the lawsuit, said, "The information leak itself is a problem, but the failure of management judgment during the post-action response process is also an important litigation issue and we will pursue responsibility until the end."

At a press conference held at the SJKP office in One World Trade Center (1WTC) in Manhattan, New York, USA on the 8th (local time), Daeryun's US local subsidiary 'SJKP LLP' explained the legal basis for the lawsuit for damages against 'Coupang Inc.', Coupang's US headquarters.

Daeryun's side said, "If you delegate the Korean lawsuit, the U.S. lawsuit will automatically proceed in parallel," and the U.S. court considers "who provided the cause" more important than the (plaintiff's) nationality. “Of course, Korean residents are also eligible to be plaintiffs,” he said.

Daeryun's side said, "We have secured more than 200 plaintiffs so far, exceeding the minimum requirement of 40 to file a lawsuit. In order to clearly persuade the court, we plan to gather victims not only in Korea but also around the world to increase the size and submit the complaint within the year."

In particular, Daeryun cited the U.S. court's discovery system as a reason for recommending that Korean victims file lawsuits in the U.S. in parallel. He emphasized that there are realistic limits to the ability of Korean investigative agencies to search and seize internal data of the US headquarters, so if the US lawsuit proceeds, confidential internal data such as the headquarters' board meeting minutes, security investment decision details, and reporting system can be forcibly disclosed through the evidence discovery process, and this could become a key 'smoking gun' in the lawsuit.

The following is a Q&A conducted with Daeryun Management CEO Kim Kuk-il, New York State attorney Son Dong-hoo, and New York State attorney Tal Hirshberg.

―If a victim who applies for a Korean lawsuit files a U.S. lawsuit simultaneously, will there be separate costs?
▶It does not occur. If you delegate a Korean lawsuit, the U.S. lawsuit will automatically proceed in parallel, and there is no separate start-up fee or additional cost. The same applies to U.S. citizens who must pursue U.S. lawsuits alone. Even if a U.S. citizen applies through the SJKP law firm website or only applies for a U.S. lawsuit through the Korean law firm Daeryun website, the fee is completely free. As this is the first case led by a Korean law firm and filed in New York, it will be carried out systematically, step by step, without burdening the victims with any costs.

-The amount of damages in Korea is only a small amount (300,000 to 1 million won). What is the expected size of a claim for punitive damages in the United States?
▶The amount awarded by the Korean court is extremely low compared to the pain suffered by the victims. On the other hand, the United States has a structure in which not only those who file lawsuits but also all victims who prove the damage can receive compensation, and the scale of the compensation is incomparably larger than that of Korea. In particular, punitive damages go beyond simple compensation and have the meaning of sounding an alarm that “companies should not be run this way.” If the court recognizes Coupang's malice or gross negligence, an astronomical compensation ruling could be issued.

―The actual damage from the information leak occurred in Korea. Is it possible to file a lawsuit against a U.S. corporation?
▶It is quite possible. The parent company that holds 100% of Coupang Corporation's shares is Coupang Inc., a Delaware corporation in the United States. The head office is responsible for overseeing server management, personnel systems, and internal controls. Even if the damage occurred in Korea, the Delaware parent company will be held directly responsible for the fact that the head office management that designed and managed the security system is avoiding responsibility without taking appropriate measures.

―What is the specific legal basis for this class action lawsuit?
▶There are two key points. First, there is a lack of data monitoring and internal control systems. Second, there was no recognition or recovery measures at the head office level after the incident occurred. Although the information leak itself is a problem, the failure of management judgment (business judgment & fiduciary duty) during the post-action response process is also an important issue in litigation. We will pursue responsibility for this until the end.

―It appears that there are securities law issues such as violation of disclosure obligations, but why are you filing a consumer lawsuit first rather than an investor lawsuit?
▶It is a strategic choice. Delaware courts have traditionally been very corporate-friendly, so the threshold for shareholder lawsuits is high. Therefore, we will first file a lawsuit focusing on user (consumer) damage in New York, etc. to secure jurisdiction, and then take a strategy of expanding the scope to include shareholder damage through an amendment.

―What is the situation of victims in the U.S. and overseas?
▶Coupang's parent company acquired British e-commerce company 'Farfetch' and holds user data in North America and Europe, and is operating under the name R.LUX in Korea. It is very likely that their information was also leaked during the system linking process. We are currently securing victims in North America and Europe, and we plan to report global damages, including these victims, in the complaint.

―How are Korean criminal complaints and American civil lawsuits connected?
▶Korean lawsuits are judged mainly on information leaks that occurred in Korea and damage to domestic consumers, but U.S. lawsuits question the management and supervision responsibility of the U.S. headquarters, which is a higher-level structure, that is, the failure of governance at a global level. Considering that Coupang's ultimate decision-making body is its U.S. headquarters, and its board of directors and management have exercised key authority over security and risk investments, reviewing legal responsibility in the U.S. is essential. Additionally, since there are a significant number of users who are U.S. citizens, permanent residents, or reside in the U.S., separate procedures for recovering damages in the U.S. are also necessary. As a result, the lawsuits in the two countries have different perspectives and legal principles, and are complementary to each other.

―Do Korean consumers have to file a lawsuit in Korea in order to participate in a U.S. lawsuit?
▶US courts consider ‘who provided the cause’ more important than nationality. Therefore, Korean residents are naturally eligible to be plaintiffs. However, since it is strategically advantageous to secure specific damage proof materials through Korean litigation, it is strongly recommended to carry out litigation in both countries simultaneously. Proceeding solely with U.S. lawsuits is limited to special cases, such as U.S. citizens.

―What is the benefit of filing a lawsuit in both Korea and the United States when the victim is the same?
▶The biggest reason is the US ‘Discovery’ system. There are realistic limits to the ability of Korean investigative agencies to search and seize internal data from the U.S. headquarters. However, if the U.S. lawsuit proceeds, confidential internal data such as the headquarters' board meeting minutes, security investment decision details, and reporting system may be forced to be disclosed through the discovery process. This will be the key ‘smoking gun’ of this lawsuit.

―When is the time to submit the complaint?
▶The legal minimum requirement for filing a lawsuit, 40 plaintiffs, has already been recruited (currently over 200 secured). You can submit it as soon as tomorrow, but the timing is being adjusted for strategic reasons. First, we must increase the scale by gathering victims not only in Korea but also around the world to truly persuade the U.S. courts. Second, it is because of the security of the litigation strategy. The specific date is being kept confidential to prevent other law firms from excessively intervening or imitating the strategy and causing confusion to victims. However, the goal remains unchanged to be submitted within the year (in December).

―Even if the total lawsuit size is 700 million dollars (about 1 trillion won), divided by the total 30 million victims, it is only about 20,000 to 30,000 won per person. Is actual damage recovery possible?
▶That’s not true. The settlement amount in a class action lawsuit in the United States is generally calculated and distributed to the plaintiffs (class members) who actually participated in the lawsuit, not to all victims. Therefore, the amount received by those who do not participate in the lawsuit and those who participate are different. I remember that in the past, AT&T and other similar information leak incidents received compensation of about 600,000 won per person. Of course, in this case, it is difficult to say in detail the expected compensation amount since the amount of damage and the number of plaintiffs have not yet been confirmed, but it is expected to be higher than the general compensation amount that can be received in Korean lawsuits.

―Has it been confirmed that the U.S. headquarters can access the Korean server?
▶Through our own research, we have identified the situation that the Delaware corporation (head office) is managing the Korean system. However, in order to secure conclusive physical evidence (server logs, etc.), a court discovery procedure is essential. This is why we file lawsuits. Only when a lawsuit is initiated can internal data be secured to prove the headquarters' management responsibility through legal enforcement.

―What is the core basis for determining that U.S. courts have jurisdiction?
▶This is because of the ‘transnational’ nature of the incident. The headquarters is located in the United States (Delaware), the platform service is located in Korea, and the security development company is located in China (Shanghai). Because this is a 'borderless' data breach case where the perpetrators, victims, and management systems span multiple countries, it is appropriate for the U.S. federal court, rather than a specific regional court, to comprehensively handle this.

―What are the specific charges (Cause of Action) that will be specified in the complaint?
▶There are three main types: △Data Breach, △Violation of Consumer Protection Act, and △Violation of Security Duty. Although there are issues related to violations of shareholders' disclosure obligations (Securities Act), the company plans to apply consumer-related charges first in order to focus on protecting victims, and will adopt a strategy of adding or merging charges (multi-district litigation) during future litigation proceedings.

Correspondent Ryu Jeong-min (ryupd01@news1.kr)

[View full article]
[Q&A] "Coupang Korean victims can file U.S. lawsuit simultaneously without additional cost" (Shortcut)