Criminal Liability under the Personal Data Protection Act B.E. 2562: A Critical Analysis of Sections 79 and 80 as Mechanisms for Fundamental Rights Protection and Implications for Legal Enforcement in Thailand

Abstract

This academic article aims to critically analyze the structure of criminal liability under the Personal Data Protection Act B.E. 2562 (PDPA), focusing specifically on Sections 79 and 80, which establish criminal sanctions for data controllers and for persons who acquire personal data of others through the performance of duties under the Act, respectively. This article proposes that while the PDPA carries significant legislative intent to protect personal data rights as a fundamental right under Section 32 of the Constitution of the Kingdom of Thailand B.E. 2560, the criminal liability framework under Sections 79 and 80 contains several jurisprudential weaknesses that undermine effective enforcement. Although the focus is criminal liability, the article also examines administrative fines and civil liability insofar as they shape how the criminal provisions operate in practice.
The article analyzes the issue across four principal dimensions: (1) an analysis of the elements of offences under Sections 79 and 80 in comparison with general principles of criminal law, particularly issues of strict liability and burden of proof; (2) a comparative analysis of the liability structures applicable to data controllers versus persons who acquire personal data through the performance of duties under the Act; (3) an examination of selected publicly reported cases and enforcement practices of the Personal Data Protection Committee Office (PDPC) during B.E. 2565–2568; and (4) a critical examination of PDPA's implications in the context of modern digital technology, including instances where PDPA has been invoked in cases involving publicly accessible personal data.

The analysis concludes that Sections 79 and 80 establish differentiated forms of liability for data controllers and persons who acquire personal data through duties performed under the Act, but possess significant weaknesses in two areas: first, the standard of proof for “damage” remains insufficiently defined in practice, and second, the prescribed penalties may be inadequate to deter violations by large organizations. This article proposes a reform framework termed the “Multi-tiered Organizational Accountability Model” (MOAM) to strengthen the effectiveness of PDPA enforcement in Thailand.