Thailand’s Ministry of Digital Economy and Society (“MDES”) recently published the latest draft of the Personal Data Protection Bill (the “Bill”) for public hearing and public consultation during the period from 22^nd January 2018 to 6^th February 2018 before the MDES revises the Bill and submits it to the National Legislative Assembly (“NLA”) for approval. It is one of the six pending bills of the digital economy laws that need to be approved by the NLA to implement the country’s digital economy roadmap.

Currently, Thailand does not have a specific law that regulates personal data protection in Thailand.  Existing laws provide protection to data in quite specific circumstances and only certain types of data/information get protection.   The Government is indeed aware of this and has been active in developing a personal data protection law to protect personal data and also safeguard public interests at the same time.  This is evidenced in the drafting of the Bill which was drawn up several years ago.  Once the Bill is passed as law, it will be the first specific law applicable to the protection of “personal data”, as part of the right to privacy generally provided by the Constitution of the Kingdom of Thailand B.E. 2560 (A.D. 2017).

According to the Bill,  “personal data” means any information or data of a person which can directly or indirectly identify a natural person by reference to the facts, data or any other materials about that natural person, excluding name, position, workplace or business address and information of a deceased person.

Under the Bill, mainly, the collection, usage or disclosure of personal data without the consent from the data subject is prohibited and a data controller must inform the data subject on the purpose for which the respective personal data is collected and obtain the data subject’s consent.  Collected personal data can be used or disclosed for the approved purposes only.  Except where the data subject expressly consented otherwise, any processing of personal data for marketing purposes is not permitted. The Bill also imposes both criminal penalties and civil liability for any violation of the provisions of the Bill.

The Bill will also establish a Personal Data Protection Commission to regulate compliance with the Bill.

The published Bill is not its final version to be submitted to the NLA for their approval.  Once the Bill is passed by the NLA, we will update readers in future issues of our newsletters.