Thailand Establishes Personal Data Protection Commission

January 19, 2022

Thailand Establishes Personal Data Protection Commission

Thailand has completed the establishment of the Personal Data Protection Commission (PDPC), the regulator under the country’s Personal Data Protection Act B.E. 2562 (PDPA), strongly indicating that the planned full enforcement of the PDPA on June 1, 2022, is likely to proceed as scheduled.

The establishment of the PDPC was finalized on January 18, 2022, when the Announcement of the Prime Minister’s Office on the Appointment of Chairperson and Honorary Members of the PDPC was published in the Government Gazette.

As stipulated in the PDPA, the PDPC consists of:

The chairperson, appointed based on knowledge, skills, and experience;
The vice-chairperson, who is the permanent secretary of the Ministry of Digital Economy and Society;
Five commission members, designated based on their positions in certain government agencies (as prescribed under the PDPA); and
Nine honorary commission members appointed based on knowledge, skills, and experience in personal data protection, consumer protection, technology and telecommunication, social science, law, health, finance, or other relevant fields.

As the vice-chairperson and the five commission members are appointed to the PDPC based on their positions, the January 18 announcement appointing the chairperson and the nine honorary commission members completes the formation of the PDPC.

The full enforcement of the PDPA has been previously postponed, and many businesses had expressed concern that another extension would be forthcoming before the current enforcement date. However, the successful establishment of the PDPC is a fundamental prerequisite to enforcement and indicates that the effective date of the PDPA on June 1, 2022, is unlikely to be further postponed. In addition, the PDPA’s draft subordinate regulations that were the subject of a series of public hearings last year are likely to be issued in the near future.

Companies and other organizations that are not yet compliant with the PDPA should now assess their current practices for handling and processing personal data in order to ensure that any compliance gaps can be closed or minimized before the full enforcement date.

For more details on the requirements under the PDPA and its subordinate regulations, please consult the Tilleke & Gibbins data privacy team by contacting Nopparat Lalitkomon at [email protected] or +66 2056 5646, Gvavalin Mahakunkitchareon at [email protected] or +66 2056 5648, or Thammapas Chanpanich at [email protected] or +66 2056 5561.

Related Professionals

Nopparat Lalitkomon

Thailand, Vietnam,

+66 2056 5646

Email

Gvavalin Mahakunkitchareon

Thailand

+66 2056 5648

Email

Thammapas Chanpanich

Thailand

+66 2056 5555

Email

RELATED INSIGHTS

December 12, 2024

Vietnam’s National Strategy on Blockchain

Vietnam is a world leader in blockchain adoption and growth, appearing near the top of most rankings of cryptocurrency ownership and blockchain investment. Although the country has taken a cautious approach toward cryptocurrency (banning the use of cryptocurrencies like Bitcoin as a means of payment, for example), the government actively supports blockchain technology and its applications in non-financial sectors. Recognizing blockchain as a core technology of the Fourth Industrial Revolution, as a part of Vietnam’s broader digital transformation agenda, the government issued Decision No. 1236/QD-TTg on October 22, 2024, providing the National Strategy for Blockchain Application and Development to 2025, with Orientation to 2030. Like the National Strategy on Digital Infrastructure, the National Strategy on Blockchain outlines a very ambitious vision to position Vietnam as a regional leader in blockchain technology. The strategy aims for Vietnam to master and apply blockchain across all socio-economic sectors, supporting the nation’s goal of becoming a stable and prosperous digital nation by 2030. The specific goals set for 2025 include developing Vietnam’s blockchain infrastructure and ensuring compliance with cybersecurity and data protection laws; advancing blockchain research through three national innovation centers; building and upgrading 10 facilities dedicated to blockchain research and workforce training; and expanding blockchain education by integrating it into university programs. The strategy also aims to establish at least one blockchain center, special zone, or area, as a pilot, to build a national blockchain network; and foster a blockchain ecosystem by promoting its application across sectors such as banking and finance, transportation, healthcare, education and training, commerce, logistics, postal services, industrial production, energy, tourism, agriculture, public services, and more. The goals for 2030 include strengthening Vietnam’s national blockchain infrastructure to support both domestic and international services, positioning Vietnam as a global and regional leader in blockchain research, application, and development. The

December 11, 2024

Vietnam Issues New Data Law

On November 30, 2024, the National Assembly of Vietnam issued a new Law on Data (“Data Law”), the first of its kind in the country. Initiated by a legislative proposal in February 2024, the Data Law underwent an accelerated preparation process and was officially promulgated just nine months later. It is worth noting that the Data Law is not the same as the Personal Data Protection Law, which is still in draft form and is expected to be submitted to the National Assembly in November 2025. The scope of application of the Data Law is broader, including not only personal data but also other types of data. The Data Law governs digital data, the National Data Center, the National General Database, digital data products and services, digital data management, and the rights, obligations, and responsibilities of agencies, organizations, and individuals related to digital data activities. Set to take effect on July 1, 2025, the Data Law is expected to have a significant impact on businesses involved in data-processing activities. Below are some key takeaways from this pivotal legislation. Cross-Border Data Transfer and Processing The Data Law recognizes and protects the freedom of cross-border data transfer and processing, as well as the legitimate rights and interests of relevant agencies, organizations, and individuals. The government is assigned the responsibility to provide detailed regulations on cross-border data transfer and processing activities, including the transfer of offshore data into Vietnam. National Data Center Resolution No. 175/NQ-CP issued by the Vietnamese government in October 2023 set out ambitious goals for a new National Data Center, which will integrate and manage human-related data from the national database, databases of ministries and central and local authorities, and other databases. The National Data Center is expected to be a core platform to provide data-related services, support policy

December 11, 2024

Thailand Releases Draft of Amended Electronic Transactions Act

Thailand has released a draft amended Electronic Transactions Act (ETA), which aims to overhaul the current version of the law from 2001 to correct its enforcement limitations and update the ETA to be consistent with current electronic transactions practice. The draft ETA is open for public comment until December 20, 2024. The draft ETA introduces a new supervisory scheme that (1) recognizes electronic transactions executed by both current and future technologies without having to enact regulations recognizing the technology, (2) replaces the licensing, registration, and notification scheme for electronic transaction service providers with a trust-mark scheme, and (3) introduces a new mechanism to regulate electronic transaction service providers. The major amendments under the draft ETA address: Relationship with other relevant laws. The draft ETA is designated as the primary law governing electronic transactions, whether between private parties or between private parties and the state. However, if specific laws—including those on electronic administrative procedures—prescribe methods for conducting particular electronic transactions, those laws will prevail. Definitions. The draft ETA revises some existing terms, such as “transaction,” which is now more clearly defined as “any act relating to civil or commercial activities, including administrative procedures, administrative contracts, and any other actions by government agencies or officials.” It also introduces new definitions, such as “biometric data,” “automated system,” and “electronic seal.” Electronic transaction reliability. The draft ETA now clearly provides that electronic transactions executed using a method or an electronic method stipulated by the Electronic Transactions Development Agency (ETDA) as reliable are themselves presumed to be “reliable.” In case of a challenge over the implementation of a certified method or certified service, the challenging party bears the burden of proof and related expenses. Electronic transferable instruments. The draft ETA adopts the UNCITRAL Model Law on Electronic Transferable Records (ETRs) in recognizing ETRs (e.g.,

December 4, 2024

Indonesia Amends Patent Law

On October 28, 2024, Indonesia officially amended its existing Patent Law when the president ratified Law Number 65 of 2024. This comprehensive update—the third such amendment in the history of Indonesia’s Patent Law—introduces several key changes that will significantly impact patent protection and application processes in Indonesia. Key highlights and changes are outlined below. Definition of Invention The new law broadens the definition of “invention” to explicitly include systems, methods, and uses. Additionally, the law introduces formal definitions for traditional knowledge and genetic resources. Patentability Criteria Notable changes include: Computer programs are now excluded, with an exception for computer-implemented inventions. Theories and methods in science and mathematics are added to the list of excluded inventions. Previous restrictions on new uses of existing products are removed. Grace Periods The grace periods for some patent-related actions have been adjusted: The grace period for disclosures has been extended to 12 months (from 6 months previously), providing inventors with more flexibility in filing patent applications after initial disclosure. A newly introduced item is the grace period for a conventional patent application claiming priority rights, which is 4 months after the 12-month filing deadline under the Paris Convention. The grace period for annuity payments is 6 months (from 12 months previously) with a fine for late payments of 100% of the annual fee payable. Patent Holder Rights and Obligations Patent holders can now grant permissions to enforce patents. There is a new requirement for patent holders to submit annual statements on patent implementation in Indonesia. Compulsory Licensing Significant changes to compulsory licensing include: Establishment of licenses based on the principle of expediency. Limitations on license scope and transferability. Prioritization of domestic market needs. New provisions for technical improvements and economic significance. Government Patent Exploitation The new law contains specific provisions for the government’s implementation

You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

Industries

Practices

January 19, 2022