Thailand – Asia’s Strong New Data Protection Law

160 Privacy Laws and Business International Report 1, 3-6, 2019

7 Pages Posted: 4 Jan 2020

See all articles by Graham Greenleaf

Graham Greenleaf

University of New South Wales, Faculty of Law

Arthit Suriyawongkul

Trinity College (Dublin)

Date Written: September 24, 2019

Abstract

Thailand’s Personal Data Protection Act of 2019 may become one of the strongest data privacy laws in Asia. It is much stronger than the previous Bill, both in terms of its principles and its enforcement. However, the picture will not be complete until the many rules that can be made by its data protection authority (the PDPC), and any Royal Decrees granting exemptions, are developed.

The main significance of the Thai law is that it is the first explicitly ‘GDPR-based’ law to yet be enacted in Asia, ahead of the GDPR-informed draft Bills in India and Indonesia, While not all of the innovations of the EU GDPR’s data protection principles are included in the PDPA, a substantial set are included. Following the Thai 2019 elections, the EU is again willing to re-commence negotiations on a free trade agreement (FTA) with Thailand and is its third-largest trading partner.

For businesses operating in Thailand, this Act imposes serious obligations, but to assess their full extent they will need to obtain much further information which is not yet available.

For data subjects the PDPA creates serious rights and remedies not previously available, and the Act overall is a major step forward. From the perspective of Civil Society, the complex administrative and enforcement structure of the Act raises difficulties in determining who could be held responsible for effective enforcement. The potential scope of exemptions are also of great concern.

The enforcement mechanisms in the Act are all much stronger than in the previous Bill. Rights of appeal against administrative fines and other decisions of the PDPC or its expert Committees, and in criminal prosecutions, might benefit from some further clarity.

All of these matters are examined in detail in this article.

Keywords: Data Protection, Privacy, Asia, Thailand, GDPR

Suggested Citation

Greenleaf, Graham and Suriyawongkul, Arthit, Thailand – Asia’s Strong New Data Protection Law (September 24, 2019). 160 Privacy Laws and Business International Report 1, 3-6, 2019, Available at SSRN: https://ssrn.com/abstract=3502671 or http://dx.doi.org/10.2139/ssrn.3502671

Graham Greenleaf (Contact Author)

University of New South Wales, Faculty of Law ( email )

Sydney, New South Wales 2052
Australia
+61 2 9385 2233 (Phone)
+61 2 9385 1175 (Fax)

HOME PAGE: http://www2.austlii.edu.au/~graham

Arthit Suriyawongkul

Trinity College (Dublin) ( email )

D2
Ireland

Do you have a job opening that you would like to promote on SSRN?

Paper statistics

Downloads
303
Abstract Views
1,409
rank
141,615
PlumX Metrics