Data Protection: Thailand

By John Formichella

john@fosrlaw.com

While more countries are working towards more comprehensive personal data protection laws, Thailand so far has not enacted any specific statutory law governing the handling and protection of personal data. With the issue of privacy and data protection becoming a more complex and robust discussion with advances in technology, data leaks, etc., and the fact that data knows no boundaries, it is likely that Thai authorities will be addressing this topic sooner rather than later. 

General principles dealing with the protection of personal data are currently scattered over many laws (including, amongst others, the Constitution of the Kingdom of Thailand, the Civil & Commercial Code, the Penal Code, the Telecommunication Business Act, the Financial Institutions Act, and the National Health Security Act). Such laws do not offer comprehensive protection and apply only to specific situations and/or industries. Further, the Official Information Act sets out restrictions on the collection, use or disclosure of personal data maintained by the government only.

Without clear regulations in place, there is much uncertainty among private businesses on their obligations with respect to handling personal data of their customers, clients, employees, etc.

Aiming to end this situation a Personal Data Protection Bill was drawn up several years ago, but so far still has not been passed into law. With the Cabinet now having approved this bill in principle, there is speculation that Thailand will one day have proper regulations in place governing this important issue. However, it is still unclear if and when the proposed bill will eventually be enacted as binding law.

If the Personal Data Protection Bill became law in the form as it currently is, a data controller would need to comply with the following:

a)      Unless permitted by law, the collection, usage or disclosure of personal data without the consent from the data subject is prohibited;

b)       A data controller must inform the data subject on the purpose for which the respective personal data is collected and obtain the data subject’s consent. Collected personal data can be used or disclosed for the approved purposes only;

c)      If a data controller intends to use or disclose personal data beyond the purpose for which consent has been obtained, he will need to inform the data subject and obtain additional consent;

d)      The collection of sensitive data (e.g. data related to sexual conduct, criminal history, health, national origin, race, political opinions or religious beliefs) is only permitted within the strict limitations of the law;

e)    Except where the data subject expressly consented otherwise, any processing of personal data for marketing purposes is not permitted;

f)      Measures must be implemented to ensure that collected personal data is protected against loss, alteration and modification;

g)     A Personal Data Protection Committee would be established and hear any claim lodged by a data subject concerning the abuse of personal data; and 

h)      Violations would be punishable under criminal law and permit the data subject to claim for damages.

This article contains information in summary form and shall be understood as general information only. It is not to be understood as and is not to be relied upon as legal advice.

© John P. Formichella. All rights reserved.