THAILAND Law and Practice Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
has breached the PDPA. Any use or disclosure of sen - sitive data without consent that causes damage to the data subject is punishable by imprisonment of up to six months or a fine of up to THB500,000, or both. However, where any use or disclosure is carried out for the undue benefit of the commercial operator, the above-stated maximum term of imprisonment and the maximum fine will be doubled. In this regard, a direc - tor or manager of a juristic person may be subject to the same penalties as the juristic person. As described in 1.8 Enforcement Proceedings and Fines , there is a PDPC Notification on Administrative Penalties that governs the enforcement and criteria relating to administrative liabilities. For civil liabilities, a damaged data subject may bring a civil suit against the controller and/or processor that has caused the damage. The PDPA expressly allows courts to award punitive damages, which are generally rare in Thailand, provided that such damages do not exceed twice the amount of actual damages (if the court considers the breach to be severe). As this civil liability is based on tort law and privacy cases often involve more than one impacted data subject, class actions are allowed for privacy cases. 2.2 Recent Case Law As described in 1.8 Enforcement Proceedings and Fines and 2.1 Privacy Litigation Overview , there have been no significant litigation cases in the area of priva - cy or data protection law in Thailand, as most matters are typically resolved at the expert committee level. At present, there is only a first-instance court judgment concerning the unlawful sale of personal data, and it remains to be seen whether this approach will be upheld or further clarified by the higher courts. 2.3 Collective Redress Mechanisms In Thailand, the concept of collective redress exists within the legal framework, commonly referred to as a “Class Action”. However, its application and pro - cedural development remain limited and continue to evolve. Victims of data protection violations are enti - tled to file a case against offenders through the Class Action mechanism, as data protection breaches typi - cally fall within the scope of tort claims. In practice, in high-profile cases (affecting many individuals), the
Office of the PDPC often encourages all victims to provide their information before an investigation is initiated and appropriate action is taken. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation Thailand does not currently have a single, horizontal “non-personal data act” that comprehensively gov - erns ownership/access/use-sharing of machine-gen - erated or industrial data (eg, IoT device data) in the same manner as the EU Data Act. Instead, non-per - sonal data is mainly governed through a patchwork of: • cybersecurity and cybercrime laws (security/inci - dent response and criminal offences); • trade secret/IP rules (confidentiality and proprietary datasets); and • public sector data governance and access frame - works (digital government, open data, official information). 3.2 Interaction of Data Regulation and Data Protection The PDPA applies as a supplementary law to other applicable statutes, to the extent that it does not con - flict with such laws. 3.3 Rights and Obligations Under Applicable Data Regulation There is no specific law addressing the rights and obli - gations, as mentioned in 3.1 Objectives and Scope of Data Regulation . 3.4 Regulators and Enforcement There is no specific law addressing regulators and enforcement matters, as mentioned in 3.1 Objectives and Scope of Data Regulation .
4. Sectoral Topics 4.1 Use of Cookies
Currently, there is no specific legislation in Thailand that regulates the use of cookies. However, as the use of cookies is considered the processing of personal
499 CHAMBERS.COM
Powered by FlippingBook