As 28^th January is a Data Privacy Day, we would like to take this opportunity to update our readers on the latest status of the Thailand’s Personal Data Protection Bill (the “Bill”).  The Bill went through public hearings and public consultations in January and September 2018. On 25^th December 2018, the Bill was submitted to the National Legislative Assembly (“NLA”) and the NLA accepted it in principle under its first reading. It is now being reviewed by a reviewing committee appointed by the NLA before it is submitted to the NLA for its 2^nd and 3^rd readings expected within 45 days after its first reading.

Once the Bill is passed as law, it will be the first specific law of Thailand that gives protection to the “personal data” in line with the right of privacy under the Constitution of the Kingdom of Thailand B.E. 2560 (A.D. 2017).

The Bill covers the following major points:-

1.   Most provisions in the Bill will come into force after 180 days from its publication in the Royal Gazette.

2.   A Personal Data Protection Commission (“Commission”) will be established to regulate compliance with the Bill.

3.   The term “personal data” means any information or data of a person which can directly or indirectly identify a natural person by reference to the facts, data or any other materials about that natural person, excluding information of a deceased person. It does not include business information like business title, business address, and business contact details.

4.   The collection, usage or disclosure of personal data without the consent from the data subject is prohibited and a data controller must inform the data subject on the purpose for which the respective personal data is collected and obtain the data subject’s consent. Collected personal data can be used or disclosed for the approved purposes only. Except where the data subject expressly consented otherwise, any processing of personal data for marketing purposes is not permitted.

5.   Parental consent for minors under 10 years old is required and a parental consent for minors over 10 years old is also necessary in certain circumstances.

6.   Consent can be exempted in several circumstances, including for the performance of contractual obligations, vital interests, public tasks, and legitimate interests.

7.   A data subject is given several rights including right to obtain a copy of data undergoing processing, the right to data portability and the right to object to the processing of their personal data in certain circumstances.

8.   In principle, a transfer of personal data to a third country may take place where the Commission has decided that the third country ensures an adequate level of protection. Some exemptions from this transfer requirement includes transferring personal data pursuant to applicable laws, transferring with consent from the data subject who has already been informed that the third country lacks a suitable level of data protection, and in case it is necessary to comply with contracts.

9.   The Bill imposes both criminal penalties and civil liabilities for any violation of the provisions of the Bill. On the civil liability, the court is empowered to levy punitive damages as high as twice the actual damages.

10.   A statute of limitation for civil cases for compensation of damages is three years from the date of knowledge of the cause of action and the identity of the responsible person, or ten years from the day when the breach of personal data was committed.

11.   Administrative fines range from THB 1 million to THB 5 million.

Once the Bill is passed by the NLA, we will update readers in future issues of our newsletters.