THAILAND Law and Practice Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
data, it falls under the principles of the PDPA, which apply to different types of cookies as follows. • Strictly necessary cookies or essential cookies are necessary for the basic functioning of a website. Explicit consent is not required as they can be used on a contractual basis. • Performance and functional cookies are used to enhance user experience and improve website per - formance. Explicit consent from users is required prior to the use of such cookies. • Targeting and advertising cookies track user behaviour for personalised advertising and are not necessary for any functions on the website, so explicit consent is required. For the general requirements applicable to any types of cookies, the PDPA requires controllers to provide clear information about the purpose and function of each type of cookie, typically through a cookie policy and cookie banners or pop-ups that inform users and obtain their consent. The information provided shall be consistent with other notifications for data processing provided to data subjects – the types of cookies used on the website, the personal data to be processed, the purposes of processing, the retention period, the rights of data subjects, etc. In addition, users must be given the ability to manage their cookie preferences, withdraw consent, and access or delete data collected through cookies. 4.2 Personalised Advertising and Other Online Marketing Practices Generally, online marketing may be based on the legit - imate interests of the data subject, or on the consent given thereby. Personalised advertising is regarded as overly intrusive for data subjects, and therefore con - sent under the PDPA is required. In addition to the PDPA, online marketing activities may fall within the scope of computer data or elec - tronic mail under the Computer-Related Crime Act B.E. 2550 (2007). Where an operator sends any com - puter data or electronic data (such as email, SMS or comments) to another person in a manner that dis - turbs that person, such operator must provide that person with an easy means to cancel or notify the wish to refuse receipt of such computer data or electronic
mail (ie, an opt-out option). Failing to do so may result in a fine not exceeding THB2 million. Once any per - son has requested to refuse such receipt, the operator must stop sending such marketing messages imme - diately (ie, no later than seven days after the request). 4.3 Employment Privacy Law Similar to other relationships, the enactment of the PDPA has significantly impacted the employment rela - tionship, particularly in relation to how employers col - lect, use and manage employees’ personal data. The PDPA requires employers to obtain specific consent from employees before collecting personal data or sensitive personal data, while ensuring transparency from recruitment throughout the entire employment lifecycle. The PDPA emphasises data minimisation and purpose limitation, requiring employers to collect only the per - sonal data necessary for specific purposes related to employment – completing the employment process, providing employee benefits, managing payroll, etc. Employers must ensure that personal data is used solely for the purposes for which it was collected and in accordance with the information provided in the employees’ privacy policy. In addition, employers are required to maintain data security measures and comply with other provisions regarding the controllers’ obligations under the PDPA (please see 3.1 Objec- tives and Scope of Data Regulation for more detail). As data subjects, employees are granted several rights under the PDPA, such as: • the right to access, correct and delete their per - sonal data; • the right to withdraw consent for data processing; and • other related rights. Employers must establish procedures to facilitate these rights, allowing employees to exercise control over their personal data and thereby enhancing pri - vacy and trust in the employer-employee relationship. 4.4 Data Protection in M&A There are no specific regulations in Thailand concern - ing the transfer of personal data in asset deals. Only
500 CHAMBERS.COM
Powered by FlippingBook