Privacy & Cybersecurity Law Blog

On February 28, 2019, Thailand’s National Legislative Assembly finally approved and endorsed the draft Personal Data Protection Act (the “PDPA”), which will now be submitted for royal endorsement and subsequent publication in the Government Gazette. Publication is anticipated to occur within the next few weeks.

The PDPA provides for a one-year grace period, such that the operative provisions concerning personal data protection, rights of data subjects, complaints, civil liabilities and penalties will take force one year after publication in the Government Gazette. The aim is to allow sufficient time for business operators to prepare and implement internal controls and systems for PDPA compliance.

In crafting the PDPA, the Thai government has largely followed and replicated the provisions of the EU General Data Protection Regulation (“GDPR”). It did so deliberately, to demonstrate that Thailand has an “adequate” level of data protection to the EU and other countries requiring the same under their own laws.

Key Requirements of the PDPA

National Data Protection Authority

A Personal Data Protection Committee will be established to enforce compliance with the PDPA.

Extraterritorial Effect

The PDPA contains provisions that have explicit extraterritorial application, which is rare for Thai law and marks a significant shift between the PDPA and Thailand’s other legal frameworks. Specifically, the PDPA will apply to the collection, use or disclosure of personal data of a data subject in Thailand that is conducted by a data controller or data processor outside of Thailand, where such processing activities relate to the offering of goods or services or the monitoring of behavior of data subjects in Thailand. (This is generally in line with the “targeting” criteria under the GDPR.) As a result, businesses that did not previously need to consider the applicability of Thai data protection law to their processing activities may now be caught within the PDPA’s territorial scope.

Operative Terms

The term “data controller” is defined as a “natural or juristic person having the power to make decision on the collection, use or disclosure of Personal Data”; “data processor” is defined as a “natural or juristic person which collects, uses or discloses personal data in accordance with the instruction of or on behalf of the data controller, provided that such person or juristic person conducting those actions is not the data controller.” The term “personal data” is defined as “information relating to a person which is identifiable, directly or indirectly, excluding the information of a dead person.”

Consent

A data subject’s consent will be required for any collection, disclosure or use of personal data.

The PDPA requires that any such consent must be express, and in writing or made through an electronic system, unless its nature does not so allow.

Sensitive Personal Data

The PDPA establishes a separate category of “sensitive personal data” that includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, criminal record, trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation, and prohibits the collection of sensitive personal data without express consent from the data subject, except in certain prescribed circumstances (e.g., medical emergency or as required by law).

Rights of Data Subject

A data subject is entitled to request access to his or her personal data, as well as submit requests to delete, destroy or anonymize his or her personal data.

Transfer of Personal Data

A data controller is expressly prohibited from disclosing or transferring personal data to third parties, except with the data subject’s consent (subject to certain limited, customary exceptions).

Where the transfer of personal data is being made to another country or an international organization outside of Thailand, such transfer may only take place where such country or international organization has an adequate level of protection—meaning, complies with the criteria for protection of personal data to be prescribed by the Personal Data Protection Committee—except for certain limited exceptions (including specific consent from the data subject to disclose to persons in a noncompliant country).

Civil and Criminal Liability

Violation of the PDPA can lead to both civil and criminal liabilities, including administrative fines.