THAILAND Law and Practice Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
Main PDPA Compliance “To-Dos” for Organisations (as Data Controllers)
• Legal obligations – required for compliance with laws relating to labour protection, social security or other statutory duties. • Public interest/official authority – necessary for the performance of duties carried out in the public interest or for the exercise of official authority. • Medical and public health purposes – necessary for preventative medicine, medical diagnosis, healthcare services or public health, subject to appropriate safeguards. • Research or statistical purposes – necessary for research or statistics, provided suitable measures are in place to protect data subjects’ rights and freedoms. Additional strict security measures must be imple - mented when processing sensitive personal data. In particular, personal data relating to criminal convic - tions or criminal offences is subject to specific sub- regulations under the PDPA. Such data may be col - lected and retained only to the extent necessary or as required by law, and must not be retained for more than six months from the date of collection, unless otherwise permitted or required by applicable law. Personal Data Relating to Minors Under the PDPA, a minor is a person under 20 years of age, unless legally married. Consent requirements • Where consent is relied upon as the lawful basis for processing, consent must be obtained from the parent or legal guardian. • If the minor is under ten years of age, parental or legal guardian consent is required in all cases. • If the minor has legal capacity under applicable law, consent may be obtained directly from the minor. Controllers must exercise heightened care when pro - cessing minors’ data, ensuring transparency, fairness and security, and avoiding unnecessary or excessive data collection. 1.4 Processing of Personal Data for Research and Development Purposes Under the PDPA, truly anonymised data (ie, data that can no longer identify a natural person, whether direct -
The primary compliance requirements are as follows: • identifying and documenting all personal data pro - cessing activities; • determining and recording the lawful basis for each processing activity; • preparing and maintaining PDPA-compliant privacy notices; • establishing procedures for handling data subject rights requests; • implementing appropriate technical and organisa - tional security measures; • managing third parties through data processing agreements; and • training employees on PDPA compliance and data protection awareness. 1.3 Special Categories of Personal Data Under the PDPA, “sensitive personal data” includes personal data relating to the following matters, among others: • racial or ethnic origin; • political opinions; • religious or philosophical beliefs; • sexual behaviour; • criminal convictions; • health data, disability and genetic data; • biometric data; and • trade union membership. The processing of sensitive personal data is prohib - ited by default, unless a specific legal basis applies. Permitted Grounds for Processing Sensitive personal data may be processed only where one of the following applies. • Explicit consent – consent must be explicit, informed and specific, and must be clearly distin - guishable from other matters. • Vital interests – necessary to prevent or suppress danger to the life, body or health of a person, where the data subject is incapable of giving con - sent.
495 CHAMBERS.COM
Powered by FlippingBook