Legal Problems for Regulating and Protecting the Privacy Rights of Children and Youth Regarding Personal Data

Abstract

This research on Legal Problems for Regulating and Protecting the Privacy Rights of Children and Youth Regarding Personal Data aims to 1) investigate concepts, theories and principles related to the protecting children’s privacy rights regarding personal data in the digital age,
2) explore legal measures for protecting children’s privacy rights regarding personal data in the digital age under foreign and Thai laws, 3) analyze the legal problems related to the protection of children’s privacy rights regarding personal data in the digital age, and 4) propose legal solutions to the legal problems related to protecting children’s privacy rights regarding personal data in the digital age. According to the study, although Section 20 of the Personal Data Protection Act B.E. 2562 prescribes the requirements for obtaining consent from minors, it does not clearly define the term ‘child’ nor establish a specific age threshold for digital consent. Instead, the age for giving digital consent is linked to the age of majority prescribed under the Civil and Commercial Code, and the Act lacks specific criteria governing the processing of personal data after consent has been obtained. The Act also lacks clarity regarding the status of consent once an individual reaches the age of majority and imposes limitations on the exercise of the right to erasure. Due to the absence of mechanisms governing the data life-cycle of personal data, together with the lack of specialized regulatory authorities with expertise in children’s issues, the protection of children’s personal data in the digital age remains ineffective and incapable of genuinely addressing technological threats. Therefore, this study proposes legislation on the protection of children’s and youths’ personal data in the digital environment as follows: 1) definitions and age thresholds for children’s digital consent, 2) the enforcement of proactive protective measures and security by design standards, 3) the establishment of data life-cycle management mechanisms and                     the recognition of the right to be forgotten upon attaining majority, and 4) the appointment of an ad hoc expert subcommittee on children and youth, and the designation of a child-specific data protection officer.