Thailand’s National Broadcasting and Telecommunications Commission (NBTC) has issued the Notification of the NBTC Re: Measures to Protect Telecommunications Service Users’ Rights Regarding Personal Data, Privacy Rights, and Freedom of Telecommunications to replace the previous 2006 notification of the same name. The replacement notification supports compliance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA), modernizes the regulations in response to technological change and the convergence of digital business, and enhances the protection of telecommunications users’ personal data, privacy rights, and freedoms. Key aspects of the replacement notification are highlighted below. User Data and Consent The notification specifies that “user’s personal data” includes name, address, ID number, mobile number, usage information, and user behavior that can identify the user. “User” does not include resellers of telecommunications services. To collect, use, or disclose users’ personal data for a purpose other than telecommunications service, service providers must obtain each user’s consent prior to or at the time of collecting the data. The consent (whether written or electronic) must be separate from the telecommunications service agreement. Service providers must clarify the purpose of collecting data, and they must honor users’ rights to opt in and opt out by providing clear and convenient channels for users to withdraw any of their information or cancel any services offered by the operator. Service providers must add an electronic channel for receiving requests from users to review, access, edit, change, or obtain a copy of their data. The electronic channel must also allow requests from users to suspend use or disclosure of their personal data and withdraw consent to collect, use, or disclose their personal data. In addition, service providers must have a system for verifying the identity of users who want to exercise the rights listed in this paragraph. Data Collection and Storage Collection

On September 14, 2023, Thailand’s Personal Data Protection Committee (PDPC) published a notification on the requirements for the appointment of a data protection officer (DPO) in the Government Gazette, taking effect on December 13, 2023. The notification on appointing a DPO lays out the criteria for what constitutes processing of personal data requiring “regular monitoring of the personal data or the system” by reason of “having large-scale personal data,” which requires data controllers and data processors to appoint a DPO under the Personal Data Protection Act B.E. 2562 (PDPA). Criteria After a hearing on the draft DPO appointment notification in July, the published version has been slightly amended while the main criteria for appointment of a DPO are still the same. These have been finalized as follows: When determining whether processing of personal data requires regular monitoring due to having large-scale personal data, only the “core activity” of the data controller or data processor is to be taken into consideration. The term “core activity” denotes an essential and integral activity directly related to the primary operations of the data controller or data processor and does not include any supplementary business activities (e.g., human resources and information technology activities). “Processing activities that require regular monitoring of personal data” refers to activities relating to tracking, monitoring, analyzing, or predicting the behavior, attitude, or profile of individuals, and generally involves the processing of personal data in a systemic manner on a usual or regular basis. Examples include membership card programs, credit scoring, insurance premium consideration, fraud prevention, processing of personal data by computer network system service providers or telecommunications operators, behavioral advertising, and so on. To determine whether processing activities constitute “large-scale processing of personal data,” various factors are considered: Volume, type, or nature of personal data processed; Duration or permanence of

Myanmar’s Ministry of Commerce has announced its E-commerce Guidelines to regulate stakeholders engaging in e-commerce. The guidelines—which were issued on September 5, 2023, and took immediate effect—are mandatory for e-commerce business operators (both entities and individuals), and failure to comply with the guidelines’ requirements may result in penalties under relevant laws. The E-commerce Guidelines come as Myanmar seeks to increase its regulation of e-commerce activities. The guidelines were preceded by a July 2023 notification requiring e-commerce business operators to register their activities with the Ministry of Commerce by January 21, 2024. Definitions “E-commerce” is defined as the sale of goods or services on the internet or other digital platforms. The term also covers sales promotions, marketing, logistics, ordering, and delivery. An “e-commerce platform entrepreneur” is a person who manages an e-commerce platform where two or more entrepreneurs can conduct e-commerce. An “e-commerce business operator” is a person operating or authorized to operate e-commerce activities. This includes e-commerce platform entrepreneurs, entrepreneurs selling on e-commerce platforms, and sellers through social media platforms. Electronic Contracts Acceptable forms of electronic contracts, which must comply with the Electronic Transactions Law, Contract Act, and other relevant laws, include: Click-wrap, click-through, and web-wrap contracts; Browse-wrap contracts; and Agreements between seller and buyer on social media platforms, such as by accepting or rejecting an offer via direct message. Samples of contract forms are appended to the guidelines. Consumer Protection Disclosure notices for consumers must be comprehensible, correct, consistent, simple, accessible, and visible. They can be written in Myanmar language, English, or Myanmar language and another language. They must also comply with the relevant provisions of the Consumer Protection Law. The guidelines provide that if the agreed delivery date is eclipsed by more than 15 days, the consumer may terminate the contract and request a full refund of

Thailand is preparing to open its first renewal period for drug marketing authorizations (MAs) since the passage of the Drug Act (No. 6) B.E. 2562 (2019). Before 2019, MAs for pharmaceuticals and vaccines in Thailand had lifelong validity. The 2019 Drug Act stipulated that all new MAs would be valid for seven years and could be renewed. The 2019 law also set out expiration dates for existing pharmaceutical products registered and approved prior to the implementation of the law (i.e., before October 13, 2019): Drug MAs issued before January 1, 1997, expire on October 13, 2024. Drug MAs approved between January 1, 1997, and December 31, 2007, expire on October 13, 2026. Drug MAs approved between January 1, 2008, and October 13, 2019, expire on October 13, 2028. Based on these dates, the first renewal period for drug MAs will commence in the fourth quarter of 2023. To facilitate the renewal process, the Thai Food and Drug Administration (FDA) has publicized draft regulations and notifications on the required application form and documents, the rules and conditions, and the process for renewing an MA. In May 2023, the Thai FDA issued Ministerial Regulation Re: Renewal of Drug MA Licenses B.E. 2566 (2023) to prescribe the essential requirements for filing a renewal application: To renew a drug MA, holders must submit their renewal application to the Thai FDA within the one-year period before the MA’s expiration date. Renewal applications can only be submitted online via the Thai FDA’s electronic system. The Thai FDA will grant approval for an MA renewal if the following conditions are satisfied: The documents in relation to efficacy and safety are up-to-date, accurate, and in accordance with academic principles. The specification and analytical method comply with the official pharmacopeias as prescribed in the Drug Act, as amended.