U.S. or Korea? Coupang's data breach lawsuit faces key jurisdiction question.

A U.S. class-action lawsuit over Coupang’s massive data breach began with a fundamental question: Should the case be heard in the United States or in Korea?

While Coupang claims to be a U.S.-based company in its lobbying and outreach to U.S. officials, at the same time it is arguing that a New York federal court lacks jurisdiction over a breach that took place on its Korean platform. 

During the first pretrial conference against Coupang that took place on Tuesday in New York, presiding judge Ann M. Donnelly repeatedly questioned why the lawsuit should be heard at the United States District Court for the Eastern District of New York rather than in Korea.

A pretrial conference allows the judge to hear arguments from both sides, identify key issues and set a schedule for further proceedings before the case moves onto an actual trial.

Daeryun Law Firm and its U.S. partner, SJKP Law Firm, earlier filed a class-action lawsuit on behalf of Coupang customers against Coupang Inc. — the U.S. parent company of the e-commerce platform — as well as company founder Bom Kim and others.

The plaintiffs alleged that the platform failed to protect customers’ personal data and breached its duty of care. They also sought $5 million in damages. 

Two Coupang customers living in the jurisdiction of the Eastern District of New York are serving as lead plaintiffs. About 7,800 people have so far expressed interest in joining the lawsuit.

Coupang Inc.’s attorneys from U.S. law firm Kirkland & Ellis asked the court to dismiss the lawsuit. They argued that a breach that occurred in Korea did not justify bringing a U.S. class action against Coupang Inc. They further argued that Coupang Inc. — a holding company incorporated in Delaware — is legally distinct from its Korean subsidiary, Coupang Corp.

Coupang’s attorneys characterized Coupang Corp. as an e-commerce platform that operates in Korea for Korean consumers, and said that pursuing the case in a U.S. court would only waste time and resources.

The irony is that argument stands in direct contrast to Coupang’s recent efforts in Washington, where it has emphasized its contributions to U.S. job creation and exports. Some members of the U.S. Congress, including the House Judiciary Committee, have also portrayed Coupang as a U.S. company facing discriminatory treatment from the Korean government.

Coupang Inc. also pointed to ongoing investigations by several Korean authorities and argued that the plaintiffs were seeking a more favorable venue and set of laws.

The plaintiffs’ side countered that Coupang Inc. is a U.S. corporation listed on the New York Stock Exchange and that executives at the parent company influence decisions at its Korean subsidiary. They argued those ties give the U.S. court jurisdiction over the case.

As further grounds for U.S. jurisdiction, they also cited the fact that Coupang Inc. disclosed the Korean subsidiary’s data breach to the U.S. Securities and Exchange Commission.

Judge Donnelly, however, appeared cautious about whether the court actually has jurisdiction. The judge repeatedly asked about the connection between the data breach and the Eastern District of New York and where the lead plaintiffs reside.

The court ordered both sides to submit additional written arguments by Oct. 6. The court is expected to decide afterward whether further hearings are necessary and how the case will proceed.

At a press conference before the hearing, Daeryun Law Firm said they will make full use of the proceedings and related documents from Korea. The plaintiffs’ representatives also pledged to do everything possible to ensure that the 33.7 million affected Korean consumers can have their rights protected regardless of national borders.

Coupang announced in November of last year that personal information belonging to 33.7 million users had been compromised, including their names, contact details, delivery addresses and access codes to residential buildings.

The availability of punitive damages in the United States has drawn attention to whether the lawsuit could expose Coupang to greater liability than it would face in Korea. If the U.S. court finds that it lacks jurisdiction, the lawsuit could end before any ruling on the case's merits, including whether Coupang failed to meet its obligations to protect customers’ personal information.

BY JEONG JAE-HONG [lee.soojung1@joongang.co.kr]