On 29^th June 2022, the Personal Data Protection Committee (PDPC) issued its Notification on Filing, Rejection, Termination, Consideration, and Duration for Consideration of Complaints B.E. 2565.  The notification was published in the Government Gazette on 11^th July 2022 and came into force on 12^th July 2022.  We summarized some key provisions of this notification below.

(1)   The data subject may file a complaint physically with the PDPC Office, by post, by electronic means or any other means as specified by the PDPC Office.  The complaint must be clear, understandable, polite and not in the nature of a threat directly or indirectly.  The required minimum details to be included in the complaint include the name and address of the complainant and the facts and related information of the alleged offences (a breach of or failure to comply with the PDPA or the PDPA rules).

(2)   If the complaint contains all the required details, the PDPA competent officer will issue an official receipt and give it to the data subject within 15 days from receiving the complaint, and then within 15 days examine and analyze the details of the complaint, and submit the complaint to an Expert Committee (EC) for consideration through the Secretary-General of the PDPC.  For examination and analysis of the complaint, the competent officer has the power to order all or any of the parties concerned to submit additional information, documents and materials related to the alleged offences.

(3)   The EC may reject or terminate the complaint if the complaint does not have all the required details, or if the parties, facts and issues involved with the complaint are those involved with the same grounds of offences under another complaint previously filed with and finalized by the EC, or if the complaint is not a case where the data controller or the data processor or their employees or contractors commit an offence under the PDPA or the PDPA rules, or if the complaint is groundless.

(4)   If the EC considers the complaint and finds that the case can be settled by mediation, the EC may mediate the case if both parties wish to settle the case by mediation. If the parties cannot settle the case, the EC shall consider the complaint further, with the power to order the parties involved to submit additional information and documentation if the EC finds them necessary.

(5)   If the EC finds that the complaint has a ground and there is clear evidence proving that the data controller or the data processor or their employees or contractors committed the alleged offences, the EC shall impose administrative fines on them per Section 90 of the PDPA.

To see the archive of our past newsletters and articles please click here.