Thailand’s Personal Data Protection Act Passes into Law

May 31, 2019

Thailand’s Personal Data Protection Act Passes into Law

Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA), approved by the government earlier this year, was published in the Government Gazette on May 27, 2019.

Provisions relating to the collection, use, and disclosure of personal data will come into force one year after publication. The law is written to be extraterritorial, meaning that it applies to data controllers regardless of their location. Therefore, all applicable business operators who collect or process the personal data of data subjects in Thailand must be fully compliant with the PDPA by May 27, 2020.

Restrictions on the Collection and Use of Data

Personal data, in the context of the PDPA, is an extremely broad term covering any data from which an individual can be identified—notably those belonging to customers, employees, and suppliers, etc., but potentially extending to any data held by a company in the course of their business.

The most significant restrictions on the collection and use of such data under the PDPA are:

a requirement for data controllers to obtain consent from data subjects (in writing or online) before they can process their personal data (subject to certain exceptions);
more stringent requirements for sensitive personal data;
a requirement to arrange sufficient security measures for storing personal data and sensitive personal data;
restrictions on the transfer of personal data to other countries;
data breach notification requirements; and,
a requirement for data controllers outside Thailand to appoint a representative within the jurisdiction, who will have certain rights and obligations.

Rights of Data Subjects

In addition, the PDPA grants data subjects various rights over data held by others that relates to them, including, amongst others, right of access, right to erasure, right to object, and the right to data portability. Data controllers must ensure that they honor and guarantee those rights as part of their operations.

Sanctions for Non-Compliance

Penalties for noncompliance are severe, with each offence potentially incurring administrative fines of up to THB 5 million, and criminal fines of up to THB 1 million. The court can also award punitive damages of up to twice the damage caused, and imprisonment for up to a year.

How to Prepare

Given the wide impact of these amendments, and the short grace period for compliance, prudent business operators should conduct a gap analysis in order to understand the classes of data that they currently possess; identify current levels of compliance; assess and mitigate the risks involved in each activity which falls under the PDPA; and review their internal policies, agreements, practices, and any other instruments related to personal data to resolve issues identified in the gap analysis before May 27, 2020.

Business operators should also take necessary actions to ensure that their employees and personnel are fully trained and ready to handle the PDPA in a practical and efficient manner. Business operators should also take the opportunity to review their systems—both online and offline—to ensure that any personal data under their possession is secure held.

If you have any questions, please contact Athistha (Nop) Chitranukroh at [email protected] or Gvavalin Mahakunkitchareon at [email protected].

Related Professionals

Gvavalin Mahakunkitchareon

Thailand

+66 2056 5648

Email

Athistha (Nop) Chitranukroh

Partner and Director, Corporate and Commercial

Thailand

+66 2056 5600

Email

RELATED INSIGHTS

November 15, 2024

Changes to Domain Name Dispute Resolution Under Vietnam’s New Internet Decree

Vietnam’s new Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (“Decree 147”), which will come into effect on December 25, 2024, replacing Decree No. 72/2013/ND-CP (“Decree 72”), introduces several changes to the regime for domain name dispute resolution. The new decree aims to clarify the legal framework and address some longstanding inconsistencies between Vietnam’s laws on intellectual property and information technology. The main changes related to domain name dispute resolution under Decree 147 are summarized below. Removal of Prescriptive Actions Decree 147 no longer lists specific actions for resolving domain name disputes. Decree 72 had outlined three methods: negotiation/mediation, arbitration, and court. However, IP practitioners had long criticized this approach, arguing it conflicted with the IP Law, which additionally allows administrative action. By omitting these methods, the new decree implies an acceptance of administrative action as provided in the IP Law. However, Decree 147 remains silent on establishing a dispute resolution forum aligned with the CPTPP’s requirement for a UDRP-like model. Currently, Vietnam’s available forums do not fully conform to the UDRP framework. An anticipated circular may provide further guidance on this aspect. Deactivation of Domain Names Decree 72 does not have any provision on the deactivation of a domain name. However, Decree 147 has stipulated some situations where domain names will be deactivated, such as when there is a request from an authority, or when it is discovered that incorrect information was used for registration. Clearer Criteria for Dispute Resolution Article 16 of Decree 147 sets out three clear criteria that must be met for domain name dispute resolution to proceed: (i) confusing similarity with the plaintiff’s trademark, trade name, or personal name; (ii) the defendant’s lack of legitimate rights or interests in the domain name; and (iii) bad faith. Previously,

November 15, 2024

Vietnam Issues New Decree Governing Internet Services and Online Information

On November 9, 2024, the government of Vietnam promulgated Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (“Decree 147”). This decree supersedes the previous Decree No. 72/2013/ND-CP dated July 15, 2013, on the same topic (“Decree 72”) and its amending regulations, and will take effect on December 25, 2024. Spanning over 200 pages, with an appendix of 62 forms, Decree 147 addresses a wide range of key internet and online topics, including internet services; domain names; cross-border information provision; social network services; aggregated information websites; online game services; app store services; information content services on mobile telecom networks; responsibilities of telecom, internet, web hosting, data center, and telecom application service providers; and measures to handle illegal content. This decree is expected to have a significant impact on both onshore and offshore service providers in the respective fields, and will potentially tighten the regulatory landscape for internet services and online information provision in Vietnam. Some highlights from the new Decree 147 compared to its predecessor are detailed below. Cross-Border Information Provision Offshore service providers, including offshore social network service providers and offshore app store service providers, who provide services on a cross-border basis and either lease data storage in Vietnam or meet a threshold of 100,000 or more total visits per month from Vietnam for six consecutive months must adhere to stricter requirements than other providers. Notable obligations of these regulated cross-border providers include: Notifying the Authority of Broadcasting and Electronic Information (ABEI) of their contact information. Monitoring and removing illegal content. Storing and managing user data as required. Authenticating social network user accounts using Vietnamese mobile number or ID number. Reporting to the ABEI annually as well as on an ad hoc Handling user complaints. Only cross-border providers who have notified the

November 13, 2024

Thailand to Set Additional Obligations for Specific Digital Marketplaces

Thailand’s Electronic Transactions Committee has publicized a new draft notification detailing additional duties for specific marketplace digital platform service operators under Section 18(2) of the Royal Decree on Operation of Digital Platform Service Businesses Subject to Prior Notification B.E. 2565 (2022). The draft notification, which is open for public comments until November 30, 2024, aims to provide enhanced protection for users of “specific marketplace platforms” (defined below). Some key points of the draft notification are detailed below. Scope The draft notification applies to “marketplace digital platform services,” which refers to digital platform services that serve as an intermediary for buying or exchanging goods and provide services to facilitate sale transactions, such as providing communication systems (e.g., chat features), shopping carts, delivery arrangements, and supplemental payment processing facilitation. “Specific marketplace platforms” refers to Section 18(2) of the Royal Decree on Digital Platform Services, which covers digital platform services that pose risks to financial and commercial security, the reliability and credibility of data messaging systems, or potential harm to the public, and that have a high level of potential impact based on the criteria for assessing the impact of digital platform service operations. Key Obligations Registration. The draft notification requires the marketplace operators mentioned above to be registered as legal entities in Thailand. Terms and conditions. The draft notification details additional obligations relating to marketplace operators’ terms and conditions: In addition to existing obligations prescribed in the Royal Decree and the relevant subordinate laws, the draft notification emphasizes that the terms and conditions must be in Thai, clear, accessible, and understandable, and may include graphical elements to aid explanation. The terms and conditions must prescribe conditions relating to the sale of products subject to specific standards, such as those restricted under the Food Act, the Drugs Act, and the Industrial Product

November 11, 2024

Vietnam’s Digital Hub Aspirations Will Open Opportunities for Investors

The Vietnamese government has demonstrated a strong commitment to building a digital government, digital economy, and digital society through its recently issued national strategy on digital infrastructure. Under Decision No. 1132/QD-TTg dated October 19, 2024, on “Digital Infrastructure Strategy to 2025 with Orientation to 2030,” the government will create supportive conditions for both domestic and international businesses to invest in digital infrastructure with cybersecurity as a priority. Recognized as vital to the economy, this digital infrastructure will consist of four main components: (i) telecommunications and internet infrastructure, (ii) data infrastructure, (iii) physical-digital infrastructure, and (iv) digital utility infrastructure, including digital technology as a service. Key goals for 2025 include universal fiber optic access for households, 100% 5G coverage across all provinces and cities, deployment of at least two new international undersea fiber optic cables, establishment of AI data centers, development of green-standard data centers, and platforms for IoT, AI, big data, blockchain, and cybersecurity. By 2030, goals include fiber access with speeds of at least 1 Gbps, 5G coverage for 99% of the population, readiness for 6G trials, six additional international undersea fiber optic cables, development of a hyperscale data center, and positioning Vietnam as a digital hub. To achieve these goals, the government has outlined some core tasks, creating significant opportunities for both foreign and domestic investors: Developing telecommunications and internet infrastructure for widespread fiber optic and 5G access, while preparing for emerging technologies like 6G, Open RAN, satellite, and IpV6. Telecommunication enterprises will jointly invest in and share the use of international fiber optic cable routes to ensure efficient capacity utilization and optimize investment capital. Attracting foreign and domestic investment to establish hyperscale data centers and cloud computing services that meet global standards. Creating physical-digital infrastructure by integrating technology across key sectors such as transportation, energy, healthcare,

You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

Industries

Practices

May 31, 2019