Thailand’s Personal Data Protection Act: An Understanding from the Perspectives of the European Privacy Law

Abstract

The Thai Personal Data Protection Act B.E. 2562 (2019) (PDPA) is Thailand’s first omnibus law that governs personal data protection in Thailand. It is predominantly based on the General Data Protection Regulation (Regulation 2016/679 or GDPR) of the European Union that came into force in 2016. Hence, there are several similarities between the two.

As PDPA’s practicality and enforceability remain largely untested in Thailand since its major operative provisions will come into effect in the middle of 2020. Thus, the author therefore compares PDPA with GDPR by investigating into GDPR and its applicability to determine best data protection practices for a company that deals with provision of financial services.

For personal data protection, PDPA and GDPR require satisfaction of one or more legal bases in order for a company to collect and process data of an individual. Obtaining consent is often seen as one method of this. However, the author finds that obtaining a consent is a key but – oftentimes – not necessary. There are several other legal bases that are as strong, if not stronger, than consent, e.g. contractual relationship and legitimate interests. Despite validity of legitimate interests as a legal basis, its coverage and applicability are not well-defined and yet conclusive. The company has to consider and evaluate individual experiences and expectations, along with industry best practices to carefully determine whether such legitimate interests have been realized and prudently balanced against individual rights.